Kaspersky experts have uncovered an ongoing phishing campaign targeting manufacturing facilities in multiple countries across Europe, Asia and the Middle East – the attackers send English-language emails purportedly from potential customers interested in products, but are actually attempting to extort corporate data.
The phishing scheme includes several stages. First, potential victims receive an email from an alleged interested buyer asking for clarification on the product, such as the exact pricing or availability.
If the recipient responds, they are then sent a link to download a file with the product’s technical specifications – either immediately in a subsequent email or after further discussion and questions. Clicking on the link takes the user to the next phishing page mimicking a popular cloud service for working with PDF documents.
The user is then directed to an “authorisation form” asking for corporate email address and password – allegedly for security purposes to prevent unauthorised access to the file. In reality, this is a ploy by attackers to trick users into revealing corporate data.
“We see spear phishing campaigns evolving,” says Roman Dedenok, Anti-Spam expert at Kaspersky. “Attackers are increasingly moving from simple schemes to complex campaigns consisting of multiple stages, as this increases the chances of a successful attack. They also thoroughly prepare, researching organisations to craft the most convincing cover stories. For example, they develop attack scenarios tailored to the specific operating conditions of manufacturing companies. Attackers often employ AI tools to craft phishing emails or automate other processes. To reduce risks, organisations need to pay increased attention to security – implementing reliable technical tools and improving employees’ cyber literacy.”