A new batch of U.K. phishing campaigns is using compromised email contacts to lure targets from the engineering, transport and defense sectors.
According to a recent advisory from the U.K.’s National Cyber Security Centre (NCSC), a “widespread phishing campaign” is now affecting multiple industries. All the phishing samples the researchers observed were similarly themed, indicating that the attacks are likely part of a larger, connected effort to compromise the engineering, transport and defense industries.
While the NCSC has yet to identify the source of this campaign, it noted that “the tools and techniques used suggest criminal involvement.”
According to the advisory, potential victims receive an email from one of their supply chain contacts whose account has been compromised. The message asks the recipient to visit a URL contained in the email or open an attached PDF that leads to a URL. In both cases, users are directed to cloned login pages for popular services such as Office365, OneDrive and Apple. The cybercriminals then attempt to capture and exploit this login data. Continued:
