Threat reportPhishingTL-2026-4027
Retirement Pension-Themed Phishing Campaign Using HTML Attachments and Web3Forms Credential Exfiltration
Retirement Pension-Themed Phishing Campaign Using HTML (TL-2026-4027) is a medium-severity phishing campaign, first published 2026-10-21. It has no confirmed attribution, affects Various Email users / corporate mailboxes (credential phishing, no, maps to 5 MITRE ATT&CK techniques (T1204, T1566, T1567), and is covered by 9 detection rules and 6 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-4027
- Threat ID
- TL-2026-4027
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, enterprise, general-workforce
- Target regions
- south korea
- Detection rules
- 9
- Indicators of compromise
- 6
How Retirement Pension-Themed Phishing Campaign Using HTML works
Phishing emails impersonating retirement pension fund notifications instruct recipients to open an attached HTML file that renders a fake login page with the victim's email address pre-filled. Entered credentials and browser information are exfiltrated to the attackers through the legitimate Web3Forms form-submission service.
AhnLab ASEC reported (2026-10-21) a credential-phishing campaign that uses a retirement pension theme. The emails are disguised as notices from a financial institution urging the recipient to check the status of their retirement pension fund, referencing a September 2026 asset status. Recipients are told to download and open an attached HTML file presented as a 'secure email' containing the pension information.
Opening the HTML attachment displays a page that mimics a legitimate login/authentication interface. The recipient's email address is pre-populated in a non-editable field, which lends credibility and removes the need for the attacker to host a per-victim page. A 'View File' button triggers the credential submission routine.
On submission, the page sends the email address, password, browser information and the time of entry to Web3Forms, a legitimate web form submission service. The attackers use the Web3Forms API with an Access Key tied to an attacker-controlled mailbox, so the harvested data is forwarded to the attacker by email. Because the egress goes to a reputable third-party service rather than attacker-owned infrastructure, domain-reputation controls are less likely to flag it.
The ASEC source does not state attribution, malware families, hashes, sender addresses or an Access Key value; none are asserted here. The campaign is retained as a TTP-driven detection opportunity: HTML attachment delivery with local credential-harvesting pages and web-form-service API egress (api.web3forms.com). Similar abuse of form-service APIs (for example Formspark and Google Forms) and HTML-attachment phishing with pre-filled victim emails has been reported by Check Point/Avanan and Sophos for other campaigns.
MITRE ATT&CK techniques used in TL-2026-4027
Execution
Initial Access
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Defense Evasion
Affected products and versions in Retirement Pension-Themed Phishing Campaign Using HTML
- Various — Email users / corporate mailboxes (credential phishing, no software vulnerability)
Remediation for Retirement Pension-Themed Phishing Campaign Using HTML
Immediate actions
- Quarantine or strip inbound HTML/HTM attachments from external senders, or open them only in a sandbox
- Hunt mail logs for retirement/pension-themed subjects with HTML attachments and purge matching messages
- Alert on proxy/DNS/EDR traffic to api.web3forms.com from endpoints with no business need for the service
- Reset credentials and revoke sessions for users who opened the attachment or submitted a password
Workarounds
- Verify sender domain and treat unsolicited attachments asking for a login with suspicion
- Access financial institutions only by typing the official address or using the official app
Longer-term hardening
- Enforce phishing-resistant MFA (FIDO2/passkeys) so harvested passwords alone are insufficient
- Restrict or inspect egress to third-party form-submission services (Web3Forms, Formspark, Google Forms) via secure web gateway policy
- Run user awareness training on 'secure email' HTML attachment lures and unexpected login prompts
- Add detections for local HTML files that POST credentials to external web APIs
Timeline of Retirement Pension-Themed Phishing Campaign Using HTML
- Check Point publishes research on HTML attachments with pre-filled victim emails exfiltrating via form services (EmailJS, Formbold, Formspree, Formspark), the same abuse pattern later seen with Web3Forms
- SANS ISC documents a comparable self-contained HTML phishing attachment with pre-filled victim email exfiltrating via a legitimate messaging API (Telegram), showing the technique precedent
- Phishing emails reference the September 2026 asset status of the recipient's retirement pension fund
- Threadlinqs retains the campaign as a TTP-driven detection opportunity (HTML attachment phishing and Web3Forms API egress)
- Fake login page with non-editable pre-filled email sends email, password, browser information and time of entry to attackers via the Web3Forms API
- Campaign emails impersonating a financial institution urge recipients to open an attached HTML 'secure email' file about pension status
- AhnLab ASEC publishes analysis of the retirement pension-themed HTML attachment phishing campaign abusing Web3Forms
Sources cited for Retirement Pension-Themed Phishing Campaign Using HTML
- "They told me to check my retirement savings balance, but now they're asking for my password?" - AhnLab ASEC
- Web3Forms API Reference
- Phorm Phishing: Using Form Service APIs to Steal Credentials - Check Point / Avanan
- Sign in to continue and suffer: attackers abusing legitimate services for credential theft - Check Point
- Self-contained HTML phishing attachment using Telegram to exfiltrate stolen credentials - SANS ISC
- Phishing and malware actors abuse Google Forms for credentials data exfiltration - Sophos
Detection coverage for TL-2026-4027
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4027 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.