Introduction:

Fraudulent campaigns aimed at top-level executives through phishing are on the rise. In this technical blog post, we will delve into a particular type of CEO phishing scam that employs an attachment containing an agreement draft. We will examine the attack's technical aspects and suggest preventive measures that businesses can adopt to safeguard themselves.

The Attack:

This form of phishing attack typically begins with the attacker conducting research on the targeted company to gather information about their financial practices and operations. Once they have the necessary details, the attacker proceeds to send an email to the CEO, masquerading as a representative of a potential business partner.

The phishing email includes an attachment that looks like a genuine draft agreement between the targeted companies. The attachment name is designed to look legitimate. The attacker requests that the CEO review and sign the agreement and return it to the sender via email.

The attachment, however, contains a hidden obfuscated javascript payload. Once the CEO opens the attachment in the web browser, the payload is executed, and the login page loaded into webpage which look exactly Microsoft 365 login window prepopulated with CEO email address. In this particular campaign, the attacker's aim is to gather the CEO’s credentials through a technique known as Credential Harvesting.

Technical Details:

The attacker uses several technical tactics to make the phishing email and attachment appear legitimate and avoid detection. Some of these techniques include:

1.

Spoofing the Email Address

The attacker utilizes email spoofing, a method of manipulating the email header to make it seem like the email originated from a legitimate source, such as a representative of a potential business partner.

2.

Malicious attachment

The attacker designs the attachment to look like a legitimate draft agreement between the two companies. However, the attachment contains a obfuscated payload that is executed once the CEO opens the attachment.

- HTML file with obfuscated JavaScript

- Deobfuscated Code

- CEO’s Email address is hardcoded into code to show the legitimacy

- Phishing web page with hardcoded CEO’s email address

- After putting random password it shows 'Incorrect password'

- Webpage will show "Incorrect password" message until you click 3 times on "Sign In" button. Once you click more than 3 times it will get redirected to legitimate Microsoft Office 365 domain.

3.

Social engineering

The attacker uses social engineering techniques to create a sense of urgency and pressure the CEO to sign the agreement quickly without seeking approval from anyone else in the company.

Preventative Measures:

To prevent becoming a victim of phishing scams that involve agreement draft attachments, organizations should implement several preventive measures, such as:

Agreement Draft Attachment:

Verifying the credibility of email attachments, particularly those containing legal documents, is crucial. If you receive an attachment that appears to be a draft agreement, take the following steps:

Conclusion:

Phishing schemes that aim at CEOs and other high-ranking executives are becoming more frequent. To remain safe and informed, it's critical to remain cautious and stay up to date with the latest phishing techniques and trends. Organizations can lessen the risk of becoming a victim of phishing attacks by implementing preventive measures such as training for security awareness, enforcing rigorous security policies and procedures, and utilizing advanced technologies like email filtering and malware detection software. It's also crucial to verify the credibility of email attachments, particularly those that include legal documents.

Indicator of compromise:

About Us:

Foresiet is the pioneering force in digital security solutions, offering the first integrated Digital Risk Protection SaaS platform. With 24x7x365 dark web monitoring and proactive threat intelligence, Foresiet safeguards against data breaches and intellectual property theft. Our robust suite includes brand protection, takedown services, and supply chain assessment, enhancing your organization's defense mechanisms. Attack surface management is a key component of our approach, ensuring comprehensive protection across all vulnerable points. Compliance is assured through adherence to ISO27001, NIST, GDPR, PCI, SOX, HIPAA, SAMA, CITC, and Third Party regulations. Additionally, our advanced antiphishing shield provides unparalleled protection against malicious emails. Trust Foresiet to empower your organization to navigate the digital landscape securely and confidently.