New Voicemail-Themed Phishing Attacks

This report describes an active July 2020 voicemail-themed credential-phishing campaign targeting large enterprises: attackers send HTML email attachments (often named with telephone icons) containing JavaScript that redirects to credential-phishing landing pages spoofing Office 365, OWA, Gmail, Mimecast and others. The campaign uses evasion techniques including encoded JavaScript, externally hosted long-named JS payloads, meta-refresh redirects, and Google reCAPTCHA to thwart automated analysis; credentials are exfiltrated (Base64-encoded) to attacker servers, and the report includes a comprehensive list of .xyz/.club/.online domains and external JS IOCs observed in the wild.