Avoid Fake Websites That Steal Credit Card Details

This report documents a phishing campaign using a fake AOL billing webpage (example: http://www.angelfire.com/ak5/billincenta/) that tricks users into entering credit card and billing information. The page uses popups to impersonate AOL, submits victims' card details via an HTTP POST to an attacker-controlled recipient email, and then redirects victims to an error page; packet capture and screenshots are provided to illustrate the exfiltration.