# Retirement Pension-Themed Phishing Campaign Using HTML Attachments and Web3Forms Credential Exfiltration

> Phishing emails impersonating retirement pension fund notifications instruct recipients to open an attached HTML file that renders a fake login page with the victim's email address pre-filled. Entered credentials and browser information are exfiltrated to the attackers through the legitimate Web3Forms form-submission service.

- **Published:** 2026-10-21T09:21:09Z
- **Last reviewed:** 2026-10-21T09:21:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4027
- **ID:** TL-2026-4027
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AhnLab ASEC reported (2026-10-21) a credential-phishing campaign that uses a retirement pension theme. The emails are disguised as notices from a financial institution urging the recipient to check the status of their retirement pension fund, referencing a September 2026 asset status. Recipients are told to download and open an attached HTML file presented as a 'secure email' containing the pension information.

Opening the HTML attachment displays a page that mimics a legitimate login/authentication interface. The recipient's email address is pre-populated in a non-editable field, which lends credibility and removes the need for the attacker to host a per-victim page. A 'View File' button triggers the credential submission routine.

On submission, the page sends the email address, password, browser information and the time of entry to Web3Forms, a legitimate web form submission service. The attackers use the Web3Forms API with an Access Key tied to an attacker-controlled mailbox, so the harvested data is forwarded to the attacker by email. Because the egress goes to a reputable third-party service rather than attacker-owned infrastructure, domain-reputation controls are less likely to flag it.

The ASEC source does not state attribution, malware families, hashes, sender addresses or an Access Key value; none are asserted here. The campaign is retained as a TTP-driven detection opportunity: HTML attachment delivery with local credential-harvesting pages and web-form-service API egress (api.web3forms.com). Similar abuse of form-service APIs (for example Formspark and Google Forms) and HTML-attachment phishing with pre-filled victim emails has been reported by Check Point/Avanan and Sophos for other campaigns.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1684.001 Impersonation
- T1567 Exfiltration Over Web Service
- T1583 Acquire Infrastructure

## Sources

- ["They told me to check my retirement savings balance, but now they're asking for my password?" - AhnLab ASEC](https://asec.ahnlab.com/en/95940/)
- [Web3Forms API Reference](https://docs.web3forms.com/getting-started/api-reference)
- [Phorm Phishing: Using Form Service APIs to Steal Credentials - Check Point / Avanan](https://emailsecurity.checkpoint.com/blog/phorm-phishing-using-form-service-apis-to-steal-credentials)
- [Sign in to continue and suffer: attackers abusing legitimate services for credential theft - Check Point](https://blog.checkpoint.com/security/sign-in-to-continue-and-suffer-attackers-abusing-legitimate-services-for-credential-theft/)
- [Self-contained HTML phishing attachment using Telegram to exfiltrate stolen credentials - SANS ISC](https://dshield.org/diary/31388)
- [Phishing and malware actors abuse Google Forms for credentials data exfiltration - Sophos](https://www.sophos.com/en-us/blog/phishing-and-malware-actors-abuse-google-forms-for-credentials-data-exfiltration)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4027