Credential Phishing via Fake Project Bid Invitations
A credential phishing campaign uses fake project bid invitations and password-protected PDFs to direct recipients to fraudulent document-sharing platforms and fake Microsoft login pages.
Triage facts
Revision 1- Evidence
- Confirmed activeHigh confidence
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 17:53 UTC
- Detection
- 7 IOCs
- Source quality
- B2Likely
Cofense Phishing Defence Centre identified a phishing campaign utilizing fraudulent project bid invitations. The emails contain password-protected PDF attachments, a tactic used to evade email security scanners that cannot inspect encrypted content. Upon opening the PDF, victims are prompted to interact with a link that mimics a OneDrive document preview. This leads to a fake document-sharing portal and subsequently a spoofed Microsoft login page designed to harvest user credentials.
Indicators of compromise
1
hash_sha256
3
ip
3
url
| Type | Value |
|---|---|
| hash_sha256 | 9ca705d6466d4d71c3fb0cae5097933afe1de1bc139d53bb63565a52dc9ebccb |
| url | https://slotpastimaxwin50jt.online/autoproject@autoproject.com/index.php |
| url | https://mm-lasertechnik.lastingonlineexperiences.de/1Dmw9/?key=NKsIDYXvtY |
| url | https://nbpn.lastingonlineexperiences.de/nasa.php |
| ip | 67.205.150.245 |
| ip | 104.21.82.118 |
| ip | 172.67.157.109 |