SEVERITY: Medium
CATEGORY: Phishing
ANALYSIS SUMMARY
A phishing campaign was observed last week, targeting bank employees in Pakistan, faking the identity of Summit Bank. Another similar and fresher phishing campaign is observed targeting about 266 bank employees in Pakistan, this time faking the identity of Bank Al-Habib.
The email looks like this:
When a user clicks on the link, they’re redirected to the URL ‘https[:]//mitz[.]pk/wp-
content/themes/twentynineteen/fonts/baalhabib/banking[.]php.
The malicious page closely resembles the login page of Bank Al-Habib’s legitimate Internet banking page.
Moreover, this is not just credential harvesting. In order to log in, users are required to provide other information by answering multiple questions. Once the information is provided, users are redirected to the original login page of the legitimate website, which is not logged in.
IMPACT
INDICATORS OF COMPROMISE
IP(s) / Hostname(s)
119[.]81[.]101[.]242
100Host[.]com
URLs
bankalhabib[.]pk
https[:]//mitz[.]pk/wp-content/themes/twentynineteen/fonts/baalhabib/banking[.]php
Email Address
info@bankalhabib[.]pk
Email Subject
BAHL Account On Hold – Urgent Action Required
REMEDIATION
Block the threat indicators at their respective controls and do not click on any email attachments or URLs received through unexpected emails.