Perception Point Attack Trends

All the attacks that we see, so you don't have to.

@PerceptionPo1nt

[Perception Point Attack Trends @AttackTrends]

Most #security vendors struggle with this kind of attack due to the sender's good reputation and complex link chains. But not us!

🔗Recursive Unpacker + 📷 Object Detection Model: Extracted #malicious URLs at every step, stopping the #threat.

#PerceptionPoint's got you 📷💪

[Perception Point Attack Trends @AttackTrends]

🚨📷 External Vendor ATO Alert!

We intercepted a sophisticated 4-step phishing attack from a compromised vendor account!
Details in the comments on how it worked and how we stopped it!

#ExternalVendorATO #CyberSecurity #EmailSecurity #Phishing

[Perception Point Attack Trends @AttackTrends]

🔍PerceptionPoint blocked the attack at every step:

#VisualSimilarity Engine: detected impersonation in PDFs, websites, and login pages

#ML Content Model: identified the email content as part of a huge phishing campaign using RFQ/RFP with legit-looking hosting site links.

[Perception Point Attack Trends @AttackTrends]

#step4

Final link leading to the #Phishing Login Page🛑:

The office forms link redirects you to another site, which hosts a fake Microsoft login page designed to steal your #credentials.

[Perception Point Attack Trends @AttackTrends]

#step3

Captcha 🔍: adding a tricky third layer, seemingly necessary for document review.

Don't be deceived—the trickery goes deeper than you think.

[Perception Point Attack Trends @AttackTrends]

#step2

https://t.co/wCxmcxDUMk site link within the PDF 📄: the email includes a PDF attachment.
Inside, there’s a link to an office forms site.
Looks official, right? Wrong.

[Perception Point Attack Trends @AttackTrends]

#step1

Fake #RFP email with a PDF attachment📨: the #scam starts with an #email requesting a #bid.

[Perception Point Attack Trends @AttackTrends]

Once you solve the CAPTCHA, it directs you to a maliciously encoded link—a fake Microsoft login page designed to steal your credentials.
Classic phishing tactic—stay vigilant! 🚨🔒

#CyberSecurity #Captcha #ThreatDetection #PerceptionPoint #EmailSecurity #credsphishing

[Perception Point Attack Trends @AttackTrends]

🚨 Attack Alert: Impersonating HR + Fake Microsoft Combined CAPTCHA to dodge security, aiming to steal credentials. Stay alert!! 🚨

An attacker attempted to deceive recipients by impersonating an HR system and sending a false updated timesheet. Details in the comments! 🛡️💪

[Perception Point Attack Trends @AttackTrends]

Blocking the context menu prevents users from inspecting or copying code, adding an extra layer of secrecy to conceal malicious activities on the CAPTCHA page.

[Perception Point Attack Trends @AttackTrends]

To ensure success, the attacker disables right-click on the CAPTCHA page, blocking users from inspecting the HTML code for potential clues or security vulnerabilities.

[Perception Point Attack Trends @AttackTrends]

This CAPTCHA mixes both text and math challenges, slipping past security checks, puzzling users, and making it tough for automated defenses to block attacks, allowing the malicious agenda to proceed.

[Perception Point Attack Trends @AttackTrends]

This fake CAPTCHA was designed to slip past security measures and conceal the easily detectable fake login page.

[Perception Point Attack Trends @AttackTrends]

🚫 The attacker poses as HR with a convincing domain to gain trust.
He supposedly emailed about an "updated payroll timesheet," urging quick action. The link led to a fake Microsoft math CAPTCHA.

[Perception Point Attack Trends @AttackTrends]

Perception Point & @pax8 team up to combat evolving cyber threats. Our advanced solutions empower MSPs to mitigate risks in email, browsers, and apps. Learn more: https://t.co/0k6x3IaMAW

[Perception Point Attack Trends @AttackTrends]

#CyberSec #phishing #awarness #malwareanalysis #incidentresponse #threatanalysis #threats #securityresearch

[Perception Point Attack Trends @AttackTrends]

Hello everyone,

We are happy to share with you fresh #Darkgate IOCs.

eml > pdf > geofenced URL > jar > ps > zip > autoit3.exe & malicious a3x script

#IOCs:
- afarm[.]net
- adventsales[.]co[.]uk

#malware #threatintel #emailsecurity

[Perception Point Attack Trends @AttackTrends]

4/4

a3x script -
MD5: 04cdff477585cb0747ecd20052f03c2e
SHA256: f3df02bf4d10415bfd8d33e0659c038465616e2190086a77dfbe0c73d229f68c

[Perception Point Attack Trends @AttackTrends]

3/4

Autoit3.exe (Not necessarily malicious as the script the it runs contains the malicious code) -
MD5: c56b5f0201a3b3de53e561fe76912bfd
SHA256: 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

[Perception Point Attack Trends @AttackTrends]

2/4

ZIP -
MD5: d0ad617ed1812822eebc9592d49a575c
SHA256: 7d7c6953c3918487997038fa8b53e369ee2fa7a0e23731fa823f1dc3d574f784

[Perception Point Attack Trends @AttackTrends]

1/4

#IOCs-
- moarhofhechtl[.]at/wp-content/plugins/image-hover-effects-addon-for-elementor/download.php (Hosted on a compromised WP domain)

JAR -
MD5: 815e20864d51b16f27d5c41a75db3650
SHA256: f20585b7183d6380968b8f1d75a34bb78b6224e5686ebb81430ec14e80fce17a