Web Page Disguised as a Naver Login Page

On January 3rd, the ASEC analysis team covered a situation where a fake Kakao login page was used to steal the account credentials of certain individuals.

Web Page Disguised as a Kakao Login Page

The team has confirmed that the threat actor used a vulnerable website to create a domain. The same method described in the above post was used to create a fake Naver login page, and we will be covering it in this post.

Emails impersonating Naver Help …

account actor analysis asec credentials domain fake january kakao login malware analysis naver steal team threat threat actor vulnerable web website