Phishing Mail Report for October 2024

1) German Railways

This phishing campaign offers alleged compensation for a delayed train connection.
To receive the refund, the recipient should click on a link in the message text.
In the example message, this link leads to “hps://url-client.vercel.app/hCrP0o” and redirects to “hps://deutsche-bahn.elbeis.de/”.
It is noticeable that the colors and logos of Deutsche Bahn are used in the email to give the impression of seriousness.

Example message:

2) ÖGK – Austrian Health Insurance Fund

Several phishing campaigns have attempted to imitate messages from the Austrian Health Insurance Fund.
The fraudsters often used the original ÖGK colors, symbols and designs to make the message appear genuine.

However, the senders’ aim is not to obtain access data to the health insurance fund, but to obtain the recipients’ full credit card details.
It is noticeable that these campaigns repeatedly use the pretext of an alleged premium refund to obtain sensitive data.

Playback campaign 1

Example campaign 2

Example campaign 3

3) ING

Several phishing emails in the name of ING have been spotted since the end of September.
The subject line read: “Update your app now”.
After a general salutation, the recipient is asked to update the app to the latest version in order to continue using the full functionality and security.

The recipient is asked to click on a button and follow the alleged instructions for updating.
The recipient should complete the update within three days, otherwise there is a threat of restrictions on the use of the app.
Such short deadlines are typical of phishing to encourage recipients to take hasty action.
The impersonal form of address and the suspicious sender address are clear indications of a phishing attempt.
As a general rule, never click on such links – a reputable bank would never proceed in this way.

4) Deutsche Bank

At the end of the week, we received a number of phishing messages aimed at Deutsche Bank customers.
Under the subject line “Action required: renew security number within 48 hours”, the recipient is asked to confirm a so-called security number.
This is supposedly required every six months.

The process should be confirmed either by SMS code or via the app.
If this is not done within 24 hours, access to the account will be blocked and a reactivation fee may be charged.
The e-mail tries to get you to click on the attached button quickly by putting you under time pressure.
Don’t be put off by this and move the message to the spam folder.
The suspicious sender address and the links within the e-mail can be quickly unmasked as a phishing attempt.

5) Generic phishing without a link

This phishing message does not contain a clickable link, but simply refers to a PDF file attached to the email.
This PDF contains a QR code that the recipient should scan.
This QR code leads to the URL “h**ps://qrfile-onlinedocuments.com/index.html#<emailadresse@empfänger>”.
Again, the page was not accessible at the time of analysis, but the use of the recipient address in the link indicates that this is an attempt to obtain the recipient’s email credentials.

Example campaign

Included PDF document incl.
QR code

6) Paypal

At the beginning of October, PayPal customers in particular were the target of phishing attempts.
The subject line was: “Account temporarily blocked”.
After a general salutation, the email claims that “unusual activity” has been detected on the account, such as a login attempt from an unknown device.
Details such as an IP address and a foreign location are provided.
To protect the account, the recipient should click on a link within 24 hours to secure the account.
Otherwise, the account could be deactivated.
Criminals use this method to gain access to sensitive data.

However, a glance at the unprofessional design and the impersonal form of address quickly reveals that it is phishing.
Also pay attention to the suspicious sender address.
To be on the safe side, you should move such e-mails to the spam folder and never click on the link.

Recognize phishing: What should you look out for?

There are some typical features that help you to identify phishing emails:

General form of address: Phishing messages often begin with impersonal phrases such as “Dear customer” or “Hello” instead of your name.

Conspicuous errors: Spelling and grammatical errors are often a sign of a dubious source.

Urgency: Pressure is often built up by threatening to block accounts or other consequences if there is no immediate response.

Unusual links: Hover your mouse over links to see where they actually lead.
Fraudulent URLs often look genuine but redirect to unknown sites.

Suspicious sender address: Make sure that the sender address really matches the company that allegedly sent the e-mail.

If you receive a suspicious message, do not reply to it, do not click on any links and move the e-mail to the spam folder.

Securely positioned with eXpurgate

Although phishing messages can often be recognized by various clues, it is essential for companies to also rely on a reliable email security solution.
Even with training for employees, there is still a risk that not all suspicious emails will be recognized – especially in the hectic working day, where there is often no time to check every message carefully.

eXpurgate uses advanced algorithms and machine learning to identify potentially dangerous emails.
With a detection rate of over 99.99% and the analysis of more than one billion emails per day, eXpurgate offers an exceptionally high level of protection.

Find out more about how eXpurgate can effectively protect you from phishing attacks and other email threats in a no-obligation consultation.