‘One-Stop Shop’ – Phishing Domain Targets Information from Customers of
Several Indian Banks[html]
FireEye Labs recently discovered a malicious phishing domain designed
to steal a variety of information – including credentials and mobile
numbers – from customers of several banks in India. Currently, we have
not observed this domain being used in any campaigns. The phishing
websites appear to be in the earlier stages of development and through
this post we hope users will be able to identify these types of
emerging threats in the future.
FireEye href="/content/fireeye-www/en_US/products/ex-email-security-products.html">phishing
detection technology identified a newly registered domain,
“csecurepay[.]com”, that was registered on Oct. 23, 2016. The website
purports to offer online payment gateway services, but is actually a
phishing website that leads to the capturing of victim logon
credentials – and other information – for multiple banks operating in India.
Prior to publication, FireEye notified the Indian Computer Emergency
Response Team.
Phishing Template Presentation and Techniques
Step 1
URL: hxxp://csecurepay[.]com/load-cash-step2.aspx
When navigating to the URL, the domain appears to be a payment
gateway and requests that the user enter their bank account number and
the amount to be transferred, as seen in Figure 1. The victim is
allowed to choose their bank from a list that is provided.
Figure 1: Bank information being requested
By looking at the list, it is clear that only Indian banks are being
targeted at this time. A total of 26 banks are available and these are
named in the Appendix.
Step 2
URL:
