Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Medium
A phishing campaign attempting to harvest credentials, specifically from the banking industry. This campaign begins with an email attempting to lure victims into clicking a link by asking them to review a proposal document. The link in the body of the email leads to a legitimate, but compromised, SharePoint site. Using a SharePoint link and a well known domain, attackers are easily able to bypass email security devices. Visiting the link leads to a OneNote document blurred in order to convince users to click another link to download the legible version of the file. This link redirects them to the final step of the attack, a OneDrive phishing page. Victims are presented with multiple options for signing on in order to increase the chances of victims falling for the phishing attempt. The researchers downloaded the content of this phishing site and identified that the login page used a PHP file to exfiltrate the credentials back to the attacker via a compromised email account. They also found other files on the site including a read me file that indicates the attacker leveraged a phishing exploit kit that can be purchased from the developer as part of a set of hacking tools.
Credential theft
URLs