Cofense Details Phishing Campaign Using Digital Invitations to Steal Credentials
Summary
Cofense analyzed a malicious digital invitation that redirected recipients to branded credential-phishing pages and attacker-controlled domains. It describes disposable-domain evasion and recommends verifying invites, reporting suspicious emails, resetting exposed, and,
Key points
- The invitation prompted recipients to log in to view event details, then redirected them to phishing pages offering Microsoft, Yahoo, AOL, Google, and Dropbox sign-in options.
- The pages returned fake errors after credential submission, potentially encouraging recipients to enter additional credentials.
- Cofense says submitted credentials were sent to attacker-controlled domains; newly registered disposable domains may evade reputation- and blacklist-based defenses.
- Observed indicators included hxxp://t[.]ly/KwKzQ and hxxps://dry[.]za[.]com/if1/; Cofense also listed associated IP addresses.
- Recommended steps include verifying unfamiliar invitations with the host, reporting irrelevant invites, resetting passwords entered on malicious sites, and enabling MFA.
Article Details
- Event Type
- Credential-phishing campaign using malicious digital invitations and branded phishing pages.
- Impact
- Submitted credentials were exfiltrated to attacker-controlled domains. The article says stolen credentials may enable account access, credential stuffing, business email compromise, identity theft, fraud, extortion, and use in web account botnets; it does not report specific victims or confirmed downstream harm.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | dry[.]za[.]com | Domain identified as attacker-controlled and used to host phishing pages and receive exfiltrated credentials. |
| IPV4 | 104[.]20[.]6[.]133 | IP address associated by the article with the observed stage 1 infection URL. |
| IPV4 | 104[.]20[.]7[.]133 | IP address associated by the article with the observed stage 1 infection URL. |
| IPV4 | 104[.]21[.]67[.]111 | IP address associated by the article with the observed stage 2 payload URL. |
| IPV4 | 172[.]67[.]221[.]157 | IP address associated by the article with the observed stage 2 payload URL. |
| URL | hxxp[:]//t[.]ly/KwKzQ | Observed infection and redirect URL used in the phishing chain. |
| URL | hxxps[:]//dry[.]za[.]com/if1/ | Observed payload URL on the phishing host used in the campaign. |
MITRE ATT&CK
T1110 · Brute ForceThe article says stolen credentials may be used for credential stuffing; this is described as a possible subsequent use, not a confirmed activity in this campaign.T1204 · User ExecutionThe credential-harvesting flow depended on recipients interacting with the invitation and clicking its RSVP or login link.T1566 · PhishingThe campaign delivered malicious digital invitations containing links that redirected recipients to credential-phishing pages.T1583 · Acquire InfrastructureThe article describes threat actors registering new domains for phishing sites and managing their DNS, certificates, and hosting.