'Heatstroke' Phishing Campaign Takes Multi-Stage Approach

guest · Sep 3, 2019

'Heatstroke' Phishing Campaign Takes Multi-Stage Approach
September 3, 2019
https://www.securityweek.com/heatstroke-phishing-campaign-takes-multi-stage-approach

The operators behind this campaign, which Trend Micro’s security researchers refer to as Heatstroke, do not employ a single landing page, and instead attempt to mimic legitimate websites to trick victims into thinking nothing is amiss.

The researchers also discovered that the phishing kit can block certain IP ranges, crawling services, and even security tools. Thus, if a connection is attempted from a blacklisted IP, service, or location, an HTTP 404 error will be served instead, or content is forwarded from somewhere else.
In an attempt to bypass firewalls, the first page of the phishing kit is generated by a PHP script encoded in Base64, Trend Micro also notes.

Credentials stolen in these attacks are sent to an email address and steganography (hiding or embedding data into an image) is employed for that. Trend Micro says it has captured two similar phishing kits, targeting Amazon and PayPal users.
Click to expand...

Trend Micro: ‘Heatstroke’ Campaign Uses Multistage Phishing Attack to Steal PayPal and Credit Card Information

Log in or Sign up

'Heatstroke' Phishing Campaign Takes Multi-Stage Approach

guest Guest

Log in or Sign up

'Heatstroke' Phishing Campaign Takes Multi-Stage Approach

guest Guest

Useful Searches