The FS-ISAC, or the Financial Services Information Sharing and Analysis Center, is the global financial industry’s go to resource for cyber and physical threat intelligence analysis and sharing. FS-ISAC is unique in that it was created by and for members and operates as a member-owned non profit entity.
Here are some examples of phishing emails that member banks have received over the past few days. I’m sending them to you to familiarize you with the types of emails that you might receive. If you DO receive any emails that appear suspicious, PLEASE notify the helpdesk, or Bill or myself. Thank you.
YOU HAVE A PACKAGE WITH DHL – DHL / Adobe Themed Phishing Email
An FS-ISAC member reported receiving a phishing e-mail purporting to be from DHL with the subject “YOU HAVE A PACKAGE WITH DHL”, containing a .pdf file attachment with an embedded URL that leads to an Adobe Online-themed credential harvesting site.
Important Account Notification – Capital One-Themed Phishing E-mail
An FS-ISAC member reported receiving a phishing e-mail purporting to be from Capital One with subject “Important Account Notification”, containing an embedded URL.
Closing Settlement Disclosure – Google Docs-Themed Phishing Email
An FS-ISAC member reported receiving a phishing e-mail with the subject “Helmsmortgage spreedsheet”, containing a .pdf file attachment with an embedded URL that leads to a Google Docs-themed credential harvesting site.
Electronic Shipping Documents Now Ready – NanoCore-RAT Phishing Email
An FS-ISAC member reported receiving a phishing e-mail with the subject “Electronic Shipping Documents Now Ready”, containing a malicious .ace file attachment that leads to Nanocore – Remote Access Trojan.
Inv <#####> – Ursnif Phishing Emails
An FS-ISAC member reported receiving phishing e-mails with subject lines in the following format: “Inv <#####>”, containing a malicious .docx file attachment that leads to Ursnif malware.
Your Email Will Be Blocked. – Webmail-themed Phishing E-mail
An FS-ISAC member reported receiving phishing e-mails with the subject line “Your Email Will Be Blocked.”, containing an embedded URL that leads to a Webmail-themed credential harvesting site.
the exorcists list – Phishing E-mail
An FS-ISAC member reported receiving a phishing e-mail with the subject “the exorcists list” containing a suspicious .doc file attachement and URLs.
Re:invoice – Phishing E-mail
An FS-ISAC member reported receiving a phishing e-mail with the subject “Re:invoice”, containing a malicious .ace file attachment that leads to a Trojan.
Total messages: 23 – Phishing E-mail
An FS-ISAC member reported observing a phishing email with the subject “Total messages: 23” containing a malicious URL.
MyFax message from “<COMPANY NAME>” – 4 page(s), Caller-ID: 1-516-799-6300″ – Adwind – RAT Phishing E-mail
FS-ISAC members reported receiving phishing e-mails with the subject “MyFax message from “<COMPANY NAME>” – 4 page(s), Caller-ID: 1-516-799-6300″ containing a malicious .zip file attachment that leads to the Adwind – Remote Access Trojan.
Complaint Letter – AutoIT Wrapped-Trojan Phishing Email
An FS-ISAC member received a phishing e-mail with the subject “Complaint Letter”, containing a malicious .zip file attachment that leads to AutoIT Wrapped – Trojan.
