Rewterz Threat Advisory – CVE-2019-1652 – Cisco RV320/RV325 Routers Command Injection Vulnerability
January 28, 2019Rewterz Threat Alert: The Cobalt gang exploiting Google App Engine to distribute malware through PDF decoy documents
January 29, 2019SEVERITY: Medium
CATEGORY: Phishing
ANALYSIS SUMMARY
A phishing campaign was observed last week, targeting bank employees in Pakistan, faking the identity of Summit Bank. Another similar and fresher phishing campaign is observed targeting about 266 bank employees in Pakistan, this time faking the identity of Bank Al-Habib.
The email looks like this:
When a user clicks on the link, they’re redirected to the URL ‘https[:]//mitz[.]pk/wp-
content/themes/twentynineteen/fonts/baalhabib/banking[.]php.
The malicious page closely resembles the login page of Bank Al-Habib’s legitimate Internet banking page.
Moreover, this is not just credential harvesting. In order to log in, users are required to provide other information by answering multiple questions. Once the information is provided, users are redirected to the original login page of the legitimate website, which is not logged in.
IMPACT
- Information Disclosure
- Credential Theft
INDICATORS OF COMPROMISE
IP(s) / Hostname(s)
119[.]81[.]101[.]242
100Host[.]com
URLs
bankalhabib[.]pk
https[:]//mitz[.]pk/wp-content/themes/twentynineteen/fonts/baalhabib/banking[.]php
Email Address
info@bankalhabib[.]pk
Email Subject
BAHL Account On Hold – Urgent Action Required
REMEDIATION
Block the threat indicators at their respective controls and do not click on any email attachments or URLs received through unexpected emails.