Trusted Design

Veil-Framework Infects Victims of Targeted OWA Phishing Attack

概要

Proofpoint researchers recently observed a novel targeted phishing attack that combined Outlook Web Access (OWA) credential phishing with a malicious document download. In May we also observed an Office 365 credential phishing attack leading to iSpy Keylogger [1], but the combination of OWA with this infection chain takes a different approach. While it is not clear whether the primary goal of the attack was delivering the malicious payload or capturing the targets' OWA credentials, this attack uses an OWA phish to additionally pushes a malicious document with a Veil-Framework payload capable of downloading further malware.

Created: 2026-02-23

Indicators

• URL - http://www2.sendsecuremail.com/bellevue/ViolationReport.xls -
• FileHash-SHA256 - ef9f15bcb18f34a47406ebdbb470a721a1f2ae90d8da7277c6dbcedf38969215 -
• URL - http://www2.sendsecuremail.com/bellevue/index.php?id=6153 -

類似Pulses

• CoT Email 20171103 (score: 0.65)
• CoT Phishing Email 20171108 (score: 0.63)
• Attack on Critical Infrastructure Leverages Template Injection (score: 0.61)
• Office 365 Phishing attacks create a sustained insider nightmare for IT | CSO Online (score: 0.61)
• Operation Toohash (2014) (score: 0.60)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る