Attackers Keep Phishing Victims Under Stress

Published: 2022-11-24
Last Updated: 2022-11-24 08:13:01 UTC
by Xavier Mertens (Version: 1)
0 comment(s)

Phishing campaigns are very common today, we receive many phishing attempts per day. Why attackers are still flooding our mailboxes with such emails? Because it sill works, and the "return on investment" of sending millions is reached even if only a few victims are lured. However, attackers are always looking for new techniques to make people confident that the message is legit. Many phishing campaigns are pretty well prepared, and the fake mail you receive looks exactly like an official one. Multiple times, I was pretty close to click on a link... Yes, we are all poor humans!

Another technique used by attackers is to try to make the victim scared and increase stress. When we are under stress, we are prone to make wrong decisions! That's the technique used by a phishing campaign that I spotted yesterday. 

If the victim follows the provided link, a message will ask the user to update his/her email account within 24h (a counter is running), but the funny fact is that the page displays a fake real-time list of disabled accounts. The list is generated with an HTML <marquee> tag:

<marquee align="center" style="height:120px; width:320px;" behavior="scroll" scrollamount="20" scrolldelay="0" direction="up">
<font face="arial" size="1" color="#FFF">
<font color="#67CC24">root@john@victim.com-server</font>:~# deleting... estellita68@john@victim.com... <br>
<font color="#67CC24">root@john@victim.com-server</font>:~# deleting... an-rickard@john@victim.com... <br>
<font color="#67CC24">root@john@victim.com-server</font>:~# deleting... mainhouseantiqu@john@victim.com... <br>
<font color="#67CC24">root@john@victim.com-server</font>:~# deleting... gfyeatonantiques@john@victim.com... <br>
<font color="#67CC24">root@john@victim.com-server</font>:~# deleting... lizabelstreasure@john@victim.com... <br>
... (Long list of fake email addresses) ...
</font>
</marquee>

Note that this tag is deprecated[1] but is still supported by most browsers.

Here is how it looks:

If you are located in the United States, Happy Thanksgiving! But keep an eye on your systems because the long weekend (tomorrow is also Black Friday!) is a good opportunity for bad guys to launch waves of attacks...

[1] https://www.w3docs.com/learn-html/html-marquee-tag.html

Xavier Mertens (@xme)
Xameco
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key

Keywords: Stress Phishing
0 comment(s)

Comments

cwqwqwq
eweew<a href="https://www.seocheckin.com/edu-sites-list/">mashood</a>
WQwqwqwq[url=https://www.seocheckin.com/edu-sites-list/]mashood[/url]
dwqqqwqwq mashood
[https://isc.sans.edu/diary.html](https://isc.sans.edu/diary.html)
[https://isc.sans.edu/diary.html | https://isc.sans.edu/diary.html]
What's this all about ..?
password reveal .
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure:

<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.

<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
https://thehomestore.com.pk/

Diary Archives