A low-detection document based phishing lure, backed by multiple free and compromised services is successfully circulating. For further information:

Phishing Lures

File name examples:

Budget Blinds of Winston statement - 08.11.2022.xlsx
KPMAM. Statement 12.04.2022.xlsx
Tonicakombucha. Statement 08.02.2022.xlsx
Chetslock Statement.xlsx
UVS. Statement 29.03.2022.xlsx
WCI Supply - Statement 09.08.2022.xlsx
Polo Corp Statement - 09.11.2022.xlsx
GVM Food statement - 09.11.2022.xlsx
Calendar Holdings LLC.xlsx
Lions Gate order.xlsx
Orill Oilfield Supplies LLC..xlsx
E-Max System - Statement 05.05.2022.xlsx
Invoice from pt.xlsx
Ramar Steel - #INV038943    05.10.2022.xlsx
The London Library 07.11.2022.xlsx
The Minto Group statement - 02.11.2022.xlsx
The Morgan Companies - 01.11.2022.xlsx
Quantum Realty II - 02.11.2022.xlsx

16 samples from InQuest Labs:

1d396e13d3ba5eb81e782b2707e7cae6eb68dc208e9148406b902f0c66b05ce0
2d0a3176b9f97a29d1d20c6d7831e06d4a4f6b6e04e9fa64c6e9012404958582
366c5c14ce9c684a318b025956f8dbf115624d94b52afc9eea3eec6b1cb0aa01
561c7d1180baac2cec00ad333402b337701d296d8ad3b3b3fe39e3a6a92d4cef
56ba00e1b58aa82c83a8ceffa7c4ffdb008bf930039e7af131db00e1011ba71c
6070eafbfadb7722d5dbada97aa29cd3ae8ff918081a13ca82a2b73bcb3918ee
7a14386b2ce2a3a2f38c85d9ba24adfb6ddc2f8c633be98b3426be3fec1fde2f
88c96fd7a5dad8969d15bd57139d5619c9a7491f1dbfd70debec29c9f5d66b52
95b1d3d5dd931a676344a186497bff2d75492f076acc5cf6b8a908381de8745c
b7632708b960fca79eb12812b2307850177adb16671000aeed33c5f37dfac75f
c64079f20e73c2ca314367259b7765aecfd882f9ea8a5343ca8f1e8b05a3ad4d
d104d02c9c3d89783d6ace326b9b26ccc5a62e800d0f052fb9302851ad022d5e
ddda0e4f6b47437672d0d69169a63c4bc9517fe7f0302b7d1f4d44979d9f6f74
e0a048e99621a8692c565d73c0f8b5fa7fd00c497d803b3cea1a4b3da4ae924d
f760b473ce410bea6221683b565c937178ebfc397441a8b340471b218b85c1e9
fdcefffc552f089b75b3dc302b2d8a06d3246108c082c71518253e4584dff5fd

Phishing Landing Pages

Various shared hosting services are being leveraged here, including:

• firebaseapp.com
• fleek.co
• web.app
• yandexcloud.net

Specific landing pages:

hxxps://c0s-datastore-c1oudstore.firebaseapp.com/?email=
hxxps://chetsl0ck-0utlook-auth-0ffice.firebaseapp.com/?
hxxps://driver022-out1ook-storage302.web.app/?email=
hxxps://ipfs.fleek.co/ipfs/bafybeib7juaxeeqc7fpih7ms5thcv4te55trjiuryrro7v3qyx7ooajgty
hxxps://ipfs.fleek.co/ipfs/bafybeicd5hu3srxk2wypgfszvtwkydjmhbew2zpzuygkx6xose3qbxyttm
hxxps://ipfs.fleek.co/ipfs/bafybeict7qf5wqksu5js5snivdsvs7zm4ah2e5zjoffx6hxmkcfuyvg3ai
hxxps://ipfs.io/ipfs/QmbUBFxNh4c4ZTPwQ5Cvu2AUFfDz25zQUSEYhEssPFwbHQ?filename=fndex.html
hxxps://ipfs.io/ipfs/QmZCrhtiiNiAkw36rGRTH4n3GrvEhp7vaqudLy34b2E93p?filename=ondex.html
hxxps://login-share-file-point-drive.web.app?email=
hxxps://login.greatfoodsllc.biz/?
hxxps://london-gov-uk.firebaseapp.com/?
hxxps://ms-0utlook-orill-sharedrive.firebaseapp.com/?
hxxps://ms1-outl00k-shar3d.firebaseapp.com/?email=
hxxps://shar3d-shar3point-st0rage.web.app/?email=
hxxps://storage.yandexcloud.net/new-excel-document/mhdex.html
hxxps://wcisupply-1nvoice-storage.firebaseapp.com/