A Phishing Page that Changes According to the User’s Email Address (Using Favicon)

The ASEC analysis team continuously monitors phishing emails, and we have been detecting multiple phishing emails that are distributed with a changing icon to reflect the mail account service entered by the user. The following is an email distributed on January 16, 2023, warning users that their account will be shut down, prompting them to click the ‘Reactivate Now’ link if they need their account kept active. The linked phishing page steals the user’s email account and password.

Figure 1. …

account address analysis asec changing distributed down email emails favicon icon january link mail malware analysis phishing phishing emails service team warning