A few months ago, Trustwave reported on an interesting site called the Chameleon Phishing Page. These websites have the capability to change their background and logo depending on the user’s domain. The phishing site is stored in IPFS (InterPlanetary File System) and after reviewing the URLs used by the attacker, we noticed an increasing number of phishing emails containing IPFS URLs as their payload.
REFERENCE: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/ipfs-the-new-hotbed-of-phishing/
ATT&CK IDS: T1566 - Phishing, T1027 - Obfuscated Files or Information, T1059 - Command and Scripting Interpreter
Read More:
Comments