Threat Alert: Compromised Accounts Distribute Malicious Email Attachments

• Cybercriminals are using compromised, legitimate email accounts to send out phishing emails.
• The phishing attacks’ use of legitimate email accounts causes the lures to appear to come from familiar senders while using vertically relevant content in the lure’s body.
• The lures contain malicious email (.eml) attachments that ultimately contain credential phishing links.
• Interacting with these links could lead to the theft of user credentials.

Key Action: Report Suspicious Emails 

• Verify the legitimacy of any unexpected email before you interact with it, especially if it directs you to click on a link or asks you to download software. Cybercriminals exploit how tempting it can be to click on a “call to action.”
• Be cautious of out-of-character emails from a known sender. Remember, some phishing attacks will compromise legitimate accounts to increase the lure’s believability.
• Report ANY suspicious emails using the Phish Alarm button.