Fake XPS Invoice Lures Recipients to a Credential-Phishing Page
Summary
Huntress examined a phishing email with a fake XPS invoice that linked to a credential-harvesting page. The article recommends layered defenses, including user training, URL reputation checks, and MFA.
Key points
- The phishing email impersonated the targeted company and used a payment request to entice recipients to open an attached XPS file disguised as a PDF.
- The XPS file prompted users to click “DOWNLOAD PDF”; the link led to a page designed to collect email addresses and passwords.
- Huntress reported that the phishing site was already down when its team tried to visit it; URLScan.io provided a screenshot of a similar credential-harvesting page on the same subdomain.
- The article recommends checking SPF records where available, training users to question email authenticity, and considering whether to accept XPS attachments.
- It also recommends checking URL reputation, using DNS reputation solutions or browser protections to block suspicious sites, and enabling MFA for email accounts.
Article Details
- Defense Focus
- Disrupt invoice-themed credential phishing by preventing delivery and access to the phishing site, reducing credential usability, and training users to recognize deceptive emails and attachments.
- Detection Methods
- Check sender SPF records where published; note that SPF does not prevent display-name or header-from spoofing.
- Check URL and domain reputation using VirusTotal URL Search, Talos Reputation Checker, or Webroot BrightCloud.
- Use browser protections that warn about or block suspicious websites.
- Data Sources
- Email sender and SPF records
- URL and domain reputation data
- User-reported or analyzed phishing email and attachment
- Platforms
- DNS reputation solutions on routers, firewalls, and endpoints
- Google Chrome
- Office 365
- G Suite
- Defensive Actions
- Train users to question email authenticity and recognize common phishing strategies.
- Consider whether to accept .XPS attachments, weighing the security benefit against potential business-productivity impact.
- Block access to phishing domains or URLs using reputation-based controls.
- Enable multi-factor authentication for email accounts.
- Validate users’ ability to identify suspicious emails through regular exercises.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | johic[.]usa[.]cc | Subdomain hosting the phishing page linked from the fake invoice. |
| URL | hxxps[:]//johic[.]usa[.]cc/VICTIMCOMPANY/Office/Share/share | Phishing URL linked from the fake XPS invoice and intended to collect email credentials. |
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe phishing page prompted victims for email addresses and passwords through a fake document-opening pop-up.T1204.001 · Malicious LinkThe attack relied on recipients opening the attached XPS file and clicking its “DOWNLOAD PDF” button.T1566.001 · Spearphishing AttachmentThe phishing email impersonated a company and used a fake invoice attachment to entice recipients to open it.
Vendors
Products
G Suite(MFA). This phishing attempt was specifically going after email accounts. By leveraging Office 365 or G Suite’s built-in MFA, a compromised password would not be enough to give the attacker access (albeit passwordGoogle ChromeError message displayed when a Google Chrome user tries to visit the phishing site.We can also deny the attacker from leveraging successfully gathered credentials by implementing multi-factor authentication (MFA). ThisOffice 365authentication (MFA). This phishing attempt was specifically going after email accounts. By leveraging Office 365 or G Suite’s built-in MFA, a compromised password would not be enough to give the attacker accessXPS Viewerdocuments, this particular email used an XML Paper Specification (.XPS) file. On Windows, the built-in XPS Viewer software will natively open these for you. Based on the attachment file name “VICTIMCOMPANY_6_4_2018