Count yourself in for a vaccine phish: new phishing campaign exploits concern over COVID-19 vaccine availability

This post details a specific phishing campaign that exploited concerns over COVID-19 vaccine availability. The campaign used sophisticated techniques including display name spoofing, SMTP HELO command spoofing, spoofing a domain without email authentication protocols that no longer resolved, and compromising a legitimate host with a benign IP address. The phishing website used a newly registered domain (NRD) and a compromised VPS in South Africa. The analysis also revealed an open directory on the phishing website containing the PHP script used to process victim information. Area 1 Security's advanced anti-phishing techniques, including early identification of attacker infrastructure, analysis of threat indicators like NRDs and look-a-like domains, real-time correlation with brand infrastructure, and lexical analysis, were instrumental in detecting and stopping this campaign.