Microsoft ATP

Nike-spoofing, job application-themed emails found in environments protected by Abnormal Security,  Mimecast, and Microsoft ATP deliver an embedded link to a Nike-spoofing website that contains a Facebook-spoofing Credential Phishing page.

Finance-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver Moixd Stealer via an embedded URL. During the time of analysis, additional Moixd Stealer payloads were found.

Oklahoma Cancer Specialists and Research Institute-spoofing, response-themed emails found in environments protected by Mimecast, Cisco IronPort, and Microsoft ATP deliver an embedded link to a Credential Phishing site and ConnectWise RAT.

Document-themed emails found in environments protected by Abnormal Security, Cisco IronPort, and Microsoft ATP deliver an embedded link to a Microsoft-spoofing website that delivers a Credential Phishing site.

Dotloop-spoofing, document-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to N-Able.

Notification-themed emails found in environments protected by Proofpoint and Microsoft ATP deliver an embedded link to a Google AppSheet-spoofing website that delivers a Malicious Downloader. When run, the downloader delivers PureRAT in memory.

FIFA-spoofing, world cup-themed emails found in environments protected by Cisco IronPort, Abnormal Security, and Microsoft ATP deliver Voidrift via an embedded URL.

HM Revenue and Customs-spoofing, taxes-themed emails found in environments protected by Proofpoint and Microsoft ATP deliver an embedded link to a Credential Phishing site.

Taxes-themed emails found in environments protected by Abnormal Security, Cisco IronPort, and Microsoft ATP deliver a ConnectWise RAT via an embedded URL. Additional payload locations for ConnectWise RAT files were found during the course of this analysis.

Notification-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver ConnectWise RAT via an embedded URL.

Adobe-spoofing, document-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link that downloads a VBS script. When run, the script delivers Level RMM.

Social Security Administration-spoofing, notification-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver ConnectWise RAT via an embedded URL.