Rewterz Threat Alert: New Phishing Campaign Targeting Bank Employees in Pakistan, Faking Identity of Bank Al-Habib

SEVERITY: Medium

CATEGORY: Phishing

ANALYSIS SUMMARY

A phishing campaign was observed last week, targeting bank employees in Pakistan, faking the identity of Summit Bank. Another similar and fresher phishing campaign is observed targeting about 266 bank employees in Pakistan, this time faking the identity of Bank Al-Habib.

The email looks like this:

When a user clicks on the link, they’re redirected to the URL ‘https[:]//mitz[.]pk/wp-
content/themes/twentynineteen/fonts/baalhabib/banking[.]php.

The malicious page closely resembles the login page of Bank Al-Habib’s legitimate Internet banking page.

Moreover, this is not just credential harvesting. In order to log in, users are required to provide other information by answering multiple questions. Once the information is provided, users are redirected to the original login page of the legitimate website, which is not logged in.

IMPACT

• Information Disclosure
• Credential Theft

INDICATORS OF COMPROMISE

IP(s) / Hostname(s)

119[.]81[.]101[.]242

100Host[.]com

URLs

bankalhabib[.]pk

https[:]//mitz[.]pk/wp-content/themes/twentynineteen/fonts/baalhabib/banking[.]php

Email Address

info@bankalhabib[.]pk

Email Subject

BAHL Account On Hold – Urgent Action Required

REMEDIATION

Block the threat indicators at their respective controls and do not click on any email attachments or URLs received through unexpected emails.