Payment-themed attacks on company mailboxes - fake remittance advices, hijacked invoice threads, and changed bank details.
View All Tags
This tax invoice contains proprietary information. Please download the attachment and enter the file password to view it. A GST invoice that masks its supplier, its goods and its bank account, names no buyer, and arrives with a password-protected ZIP — whose password is printed in the email, and again in the attachment's own filename.
You have Two (2) Messages Pending Delivery on Your E-mail Portal. A notice claiming to be your own domain's web administrator, sent from an animal-feed company's accounts mailbox, whose button opens a page the attacker uploaded into a Google Cloud Storage bucket.
Your payment has been successfully processed. Please find the attached SWIFT advice and supporting documentation for your records. Four lines of flawless business English, a Re: subject line for a conversation that never happened, and a 140 KB PDF that is the entire attack.
Dear Support. You have a fax document from Xerox Scanner. Pages: 2 Full scanned PDF/HTML File. Remote ID: 34455191. Priority Notice - Review Doc_Xerox File Shared
Dear Support. You have a fax document from Xerox Scanner. Pages: 2 Full scanned PDF/HTML File. Remote ID: 34455191. Advice - Remittance 86,000 Process.
