A Real Vendor RFQ, a Fake Google Login Page
ID: f2d041f0-d4ab-5f55-91f8-5c7c303f1332
STIX ID: report--f2d041f0-d4ab-5f55-91f8-5c7c303f1332
Feed Name: IRONSCALES
Threat Score
An RFQ from a compromised industrial-vendor account contained a link labeled "Agreement Terms.xlsx" that led via a month-old intermediary domain (jinqyemetals.com) through three 302 redirects to a Google Sites page and an accounts.google.com login prompt designed to harvest credentials; per-URL scanners and email authentication passed, but behavioral analysis detected the filename-vs-href mismatch and redirected login and quarantined the message.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.