Threat video1:00
Fake Holiday Rental Phishing Live Chat: Detection & IOCs
Lookalike rental sites use a staffed live chat to coax travelers into entering cards and passwords; 9 detection rules, 2 IOCs, one free Splunk SPL rule.
Read the full threat intel for Fake Holiday Rental Phishing Live Chat: Detection & IOCs →
Chapters
- 0:00The hookPhishing sites harvest traveler data in 3 stages
- 0:04The storyFake rental listings lure holiday travelers
- 0:12Attack pathLookalike booking domains clone real listings
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise1 indicator to hunt: 1 domain.
- 0:37MITRE ATT&CK techniques6 ATT&CK techniques, from reconnaissance to impact.
- 0:42Remediation4 steps now: Block or sinkhole.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Phishing sites harvest traveler data in 3 stages
0:05Fake rental listings lure holiday travelers
0:08A live chat agent convinces them to pay
0:12Lookalike booking domains clone real listings
0:15Fake forms collect passwords, details
0:18A chat agent reassures the victim to pay
0:20Card data captured in fake payment
0:27No threat actor is attributed. Confidence: low.
0:321 indicator to hunt: 1 domain.
0:386 ATT&CK techniques, from reconnaissance to impact.
0:434 steps now: Block or sinkhole.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.