Ongoing phishing campaign hosted on Netlify

The threat actor we've previously discussed has been conducting a phishing campaign for some time. Today, they've started using Netlify.app subdomains for their operations.

Sample email #1:

your_email_address have Incoming Pending Messages
You have Incoming Pending Messages

The following messages have been blocked by your mail-server due to validation error.
You have six pending messages .


Incoming  Messages:
Status :                Subject:
your_email_address      Fwd: Payment  ------ forwarded message ----
your_email_address      Re: Statement Of Acoount 	date
your_email_address      RE: Updated PI
your_email_address      Zoom meeting request tomorrow	date.
your_email_address      Re: New Account Details
your_email_address      Re: Shipment	date.

[ DELIVER ALL MAILS ]


Note: The messages will be delivered within 1-2 hours after you receive a confirmation mail notice.
This message was sent by the MailDaemon server honeypot notification.


Thank you!

Copyright© 2024 Webmail, Inc.

The DELIVER ALL MAILS button and message links all point to a URL in the format:
https://*.netlify.app/#target_email_address

Clicking the link loads the same fake cPanel branded login page we discussed earlier. Unlike the IPFS forms, this form posts back to itself.

The current iAntiSpy for macOS anti-phish database provides immediate protection against all known variants of this threat.