
3/15/2023 · Shalabh Mohan, Blake Darché
What this post added
This post details Cloudforce One's proactive monitoring and detection of phishing campaigns leveraging the Silicon Valley Bank (SVB) brand following its collapse. It describes a specific KYC phishing campaign using a DocuSign-themed template and a multi-stage redirect chain involving Sizmek, Google Firebase, and a WordPress site, ultimately leading to an attacker-controlled domain. The post provides indicators of compromise and recommendations for customers, including specific search terms for Cloudflare Email Security, DMARC policy enforcement, and the importance of WAF protection for public-facing applications.