Phishing Web Server Identified Through an Impostor National Tax Service Email

The ASEC analysis team recently discovered that a phishing email impersonating the National Tax Service was being distributed. This phishing email emphasizes the urgency of the company email password expiring on the same day, and it is being sent with a message urging recipients to extend their password duration before the account is locked.  

Figure 1. Original email

Figure 2. Phishing site for entering account information

Figure 3. Source code of the login page

Clicking the hyperlink inserted to the …

account analysis asec distributed email impersonating information locked malware analysis message national password phishing server service tax team the company web web server