Share:

By Elmer Hernandez, Cofense Phishing Defense Center

The Cofense Phishing Defense Center (PDC) has spotted a phishing attack directed at mobile users purporting to come from Three, a British telecommunications and internet service provider. The attack relies on a well-spoofed html file, enticing users to provide everything from their password and personal details to their credit card information. 

Users are informed of a bill payment that could not be processed by their bank. They are urged to download the html file “3GUK[.]html” to edit their billing information in order to avoid service suspension. Users should always be wary of requests to download and open html/htm file attachments as opposed to being linked directly from their email client (which also, of course, is no guarantee of a legitimate email).

Figure 1 – Email Body

Spoofed Phish Page

As seen in Figures 2 and 3, The attached 3GUK[.]html file then requests login credentials, personal information and credit card details. The source code indicates this is a clone of actual Three html code, re-appropriated for malicious purposes; for instance, styling elements are pulled from actual Three websites. Additionally, all options in 3GUK[.]html direct to the legitimate relevant Three page so that, for example, if one clicks on “iPhone 11” under the Popular Phones section at the bottom, the end user is redirected to the real Three iPhone 11 page.

Figures 2 and 3 – Cloned Phishing Pages

The smoking gun is in the action attribute of the HTML form element. Figure 4 confirms that any information provided is processed by the “processing[.]php” script, located at hxxp://joaquinmeyer[.]com/wb/processing[.]php, a domain the adversary has compromised. Adversaries need only modify key sections of the cloned html code such as in Figure 4 below in order to turn benign code into a convincing phish.

Figure 4 – Malicious cloned html code

The Devil is in the Metadata

The From field, as seen in Figure 5 below, indicates “online@three[.]co[.]uk” as the apparent source of the email. The SPF check shows this was the address provided in the SMTP MAIL FROM command. We also see a SoftFail result for the originating IP 86.47.56.231; this means the domain of three.co.uk discourages, but does not explicitly rule out, this IP address as a permitted sender.

Figure 5 – SPF check

In other words, the SPF records for the domain of three[.]co[.]uk contain the ~all mechanism, which flags but ultimately lets the email through. Worried that legitimate email will be blocked by a stricter SPF policy, such as a (Hard)Fail with -all, many companies’ SPF records do not dare make an explicit statement regarding who is and is not permitted sender, potentially enabling spoofed emails.

DNS PTR record resolves the originating IP 86.47.56.231 to mail[.]moultondesign[.]com. Although an apparent subdomain of moultondesign[.]com, there is no evident relation between the two. There is no corresponding DNS A record, as confirmed by a Wireshark capture, as seen in Figure 6. The supposed parent domain is hosted by Namesco Ireland at 195.7.226.154, unlike the malicious IP address which is part the ADSL Pool of Irish provider EIR, suggesting a residential use.

Figure 6 – Missing DNS A Record

The email also contains a spoofed Message-ID (Figure 7). Although these do not need to conform to any particular structure, they often contain a timestamp. In this case, the digits on the left of the dot seem to follow the format YYYYMMDDhhhhss, amounting to 2020 February 5th 16:34:08; the digits to the right of the dot could or could not have any significance. Finally, the presence of Three’s Fully Qualified Domain Name adds a further element of credibility that might deceive more tech-savvy users.

Figure 7 – Message-ID

IOCs:

Malicious URLs:
hxxp://joaquinmeyer[.]com/wb/processing[.]php
mail[.]moultondesign[.]com

Associated IPs:
65.60.11.250
86.47.56.231

 

HOW COFENSE CAN HELP

75% of threats reported to the Cofense Phishing Defense Center are credential phish. Protect the keys to your kingdom—condition end users to be resilient to credential harvesting attacks with Cofense PhishMe.

Over 91% of credential harvesting attacks bypassed secure email gateways. Remove the blind spot—get visibility of attacks with Cofense Reporter.

Easily consume phishing-specific threat intelligence in real time to proactively defend your organization against evolving threats with Cofense Intelligence. Cofense Intelligence customers were already defended against these threats well before the time of this blog posting and received further information in the Active Threat Report 37144.

Quickly turn user-reported emails into actionable intelligence with Cofense Triage. Reduce exposure time by rapidly quarantining threats with Cofense Vision.

Thanks to our unique perspective, no one knows more about the REAL phishing threats than Cofense. To understand them better, read the 2019 Phishing Threat & Malware Review.

 

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.