Angler Catches Victims Using Spam as Bait
Summary: Cisco Talos found a spam campaign that linked recipients to hidden pages on 22 compromised WordPress sites, all ending in /order/order_details.html, rather than the usual malicious iframes. The campaign lasted only a couple of hours, used roughly 900 company names including Amazon, AT&T, Comcast and General Electric, and routed through a single Angler server at 207.244.95.41, with a 302 redirect to att.com seen during analysis.
Key Takeaway: The lure was a fake "Your Online Order was Successfully Submitted" email carrying a well-known brand name, and the whole campaign was live for only a couple of hours - a window most email and web controls would need to catch in near real time.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026