Essential Insights
- Pension-fund phishing emails use attached HTML files to display fake “secure document” login pages.
- The pages steal email addresses and passwords, plus browser details and entry timestamps.
- Stolen data is exfiltrated through Web3Forms, a legitimate form-submission service.
Threat, Techniques, and Targets
Threat actors used retirement pension notices to lure recipients into opening an attached HTML file. The message claimed that recipients could view their pension fund status through a secure email.
When a recipient opened the file, a fake document login page appeared. The page prefilled the recipient’s email address and did not allow changes. It then prompted the recipient to enter a password.
After the recipient clicked “View File,” the page sent the email address, password, browser information, and entry time to an external service. The threat actors exploited Web3Forms, a legitimate form submission service, to collect this information. The lure may appeal to office workers and others interested in retirement funds.
Impact, Security Implications, and Remediation
The attack exposed email credentials and other information to threat actors. Therefore, recipients should treat unexpected login prompts in email attachments as suspicious.
Verify the sender’s email domain, and check links and attachments before opening them. Also, confirm that a website address matches the financial institution’s official site before entering credentials. HTTPS or a padlock icon alone does not prove that a site is legitimate. Instead, visit the institution’s official website or app directly to check pension information.
The source does not provide steps for responding after someone submits credentials. In that case, seek guidance from the email provider, financial institution, or relevant authority.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
