Our SOC analysts have discovered and analyzed a new phishing campaign targeting banks in Pakistan. These phishing emails successfully bypassed the email security controls and targeted multiple users in an enterprise environment. The email uses the subject Password Change Request Accepted, to create an urgency to trigger user response, as users will suspect that someone is attempting to change their password and would immediately take action. The sender’s email address is from the domain administrator[.]com which is detected as malicious on threat intel forums.
The email offers a Cancel Request button, which a user will click on, in order to prevent a password change attempt. Upon clicking the cancel request button, user will be redirected to a URL which is a fake login page for roundcube webmail service designed for credential harvesting. The website uses strict validations and has a SSL certificate as an advanced deception technique which tricks the users into believing that the page is secure and legitimate.
Once the user enters the credentials, they will be redirected to the same username domain. For example, if the user entered “User@rewterz.com” the user would be redirected to the rewterz mail domain. The embedded code is crafted in a way that it reads the email entered in the username field and parses its domain.
Sender contains : “no-reply[@]administrator[.]com” or “@administrator.com”
Subject contains : “Password change request accepted”
URL contains : “output.[your environment name]bin.com/hodiqis” for example : “output.rewterzbin.com/hodiqis”