The Home Office Phish With Five Dead Links
ID: 1fe2e960-960e-580d-bcd6-ceffbf79a47b
STIX ID: report--1fe2e960-960e-580d-bcd6-ceffbf79a47b
Feed Name: IRONSCALES
A targeted credential-harvesting phishing campaign impersonated the UK Home Office with a one-page PDF attachment that contained a single live "Complete upgrade" button linking to an HTML page hosted in a Contabo EU object-storage bucket; the PDF had no scripts or embedded malware but used visual GOV.UK branding and hollow footer links to bypass link-based filtering, was delivered to multiple mailboxes despite failed DKIM/DMARC, and produced IoCs including sender domain (mail.getalertinfo.com), sending IP (51.195.101.247), attachment hash (md5 bbaf9fcb24c94d85273239de7fc0531e), and the container URL.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.