About Cofense
About Cofense
Free Tools
Free Tools
Build Resilience
Create Transparency
Speed Response

Welcome to the Cofense Blog

Get the latest information on phishing threats and trends, BEC, ransomware and credential phishing, plus Cofense product updates.

Follow us on Social Media

New Phishing Campaign Leverages Income Tax Refunds

Found in environments protected by:

By Adam Martin & Janos Torok, Cofense Phishing Defense Centre

The Phishing Defensce Center (PDC) recently detected a campaign leveraging the theme of income tax refund, a topic anyone would be intrigued to engage. As illustrated below, the initial email is mirroring an email notification from the German federal government, shown in Figure 1.

Figure 1 Initial Email Body

Figure 2: English Translation 

This campaign is an income tax refund of 268.85 euro with instructions given to the recipient on how to claim this rebate. The typical trope of a time limit is used with a 4-day timer placed, the recipient is redirected to a spoofed page that redirects to a malicious page once accessed. It’s recommended the recipient access the site via their mobile phone under the guise a further layer of confirmation will be given via SMS.

The initial landing page, in Figure 3, is quite well put together with a host of different banking institutions listed: PostBank, ING, Volksbank & Deutsche Bank amongst others. What’s clever about this landing page is the fact that all the “clickable” brand logos all redirect back to the official Bundesegierung page. Adding a confidence boost of legitimacy is given to the user with the mention of further verification methods mentioned in the below paragraph.

Figure 3 First Landing Page 

What makes this Phishing attempt very convincing, is the absence of a generic “please input details here” box that tends to be paired with typical attempts at credential theft. Instead, each banking institution listed has its own customised landing page accompanied by the logos, banners & replicated login information input boxes.

Figure 4Fake Santander Page 

Figure 4 is an example of a crafted Santander Bank login page asking for account details to access online banking. While the overall looks of the page might be convincing, there is an obvious indicator that this is a spoofed page. The URL, which is a generic hosted domain, not mentioning Santander anywhere. This indicates that the domain is not owned or associated with Santander. The sole purpose of this site is to get the user’s online bank credentials.

Figure 5 Fake Deutsche Bank Page 

In Figure 5 we see another example, a spoofed page for the Deutsche Bank online banking page. This is again a well-crafted site mirroring the exact login steps of the real login page.

Again, we see It is clearly visible that the URL is the same generic host which is not linked to Deutsche Bank, with the intent to steal banking credentials.

Overall, this example of credential phishing is building on two main principles which make it dangerous to the unexperienced eyes. The first is creating a false sense of excitement of unexpected funds, with reasonable, realistic amounts, that gives the impression that it can be true. It also builds a feeling of urgency, so that the recipient act quickly not to miss out on the free money. This is only meant to lower the victim’s guard and blind them with false hope.

The second is the quality of these crafted sites, which look legitimate at first, therefore reinforcing a sense of false security and convincing the user into going through with the attack.

As phishing attempts are becoming more sophisticated, potential victims need to be more vigilant and look for the signs that indicate this might be.


Indicators of Compromise IP
hXXps://security-de[.]ddns[.]net/root/index[.]php 91[.]218[.]67[.]101


All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats. Past performance is not indicative of future results.  

The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.