---
title: "Phish Wire - Oct 28 2024"
slug: "phishwire-oct-28-2024"
updated: 2024-10-28T15:54:52Z
published: 2024-10-28T15:54:52Z
canonical: "help.rapididentity.com/phishwire-oct-28-2024"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.rapididentity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Phish Wire - Oct 28 2024

## Phish Wire: October 28 2024

October continues to see aggressive phishing campaigns targeting district staff, particularly using delivery methods outside district mailboxes. We will provide a few examples and highlight some key points.

  

- mkvg[.]diflucan50[.]com
- a0ueftsev[.]online
- ovalthebar[.]info
- 4af3dac0-d9b7-4472-b338-2c87d939d856-00-v7je93cxpf67[.]spock[.]replit[.]dev/
- evolutionindia[.]co[.]in/dist/
- celebritybollywoodactions[.]com/dist/
- gerenciar[.]com[.]co/dist

  

**Widespread Document Share Phishing Campaign**

  

Multiple school districts were hit with phishing attacks that were delivered through shared documents.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXciqjB_MFiQtm6GRzQ0lmYZwETYv3XLLDKt0seuKLsgJtnia9aay0yDb8QiESY52mLUQsfG8RAoppvvmuItpGv9uEiks7JObpsqKRDjNoJFwOxJOTCJgrmrCk0KOmC34EcDWJVnjyyaMUwss3nPY_lQl4p_?key=_9AEd6Hf-89JD29XLSSrFg)

In a Colorado district, on October 17th, this was clicked by seven staff members over an 8 hour period, as well as multiple administrators in other Texas districts. In fact, a PhishID analyst was able to inspect a similar one that hit an Idaho district on October 15th.

  

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXd_z5uu24defhRw70qke8SSiKulhG1DaWBxl8GFBmWS0N45jzyIS1n8Nug5Upeo_pXL6rBhNGJflGZYcYrU4PDmqbMlyl2jwMblqDCWBK4cEUE6veAppW-az2wkw5DTnfTflbWstGxNGrpg81q8-E6b6lw?key=_9AEd6Hf-89JD29XLSSrFg)

In addition to Outlook, the phishing attack allows the user to select Office365, AOL, Yahoo, and other email options.

We saw a separate Outlook phishing attack get clicked by a staff member in another district.

  

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXf7wRWp7jHQH3QwUupGPSJeFsB5WOSHwt1_ulX4Pfo6ivKa9aAK0PBGdfRO_RlV-r8Dk6r6z5_D1bBg0zAdhHldx-FkzqRp3I3CiSnWLu_v172xTzoKTfoERb-oxk5EHkRAmA5Zs9PdIGooRzcff2XK9Ee8?key=_9AEd6Hf-89JD29XLSSrFg)

The district administrator confirmed that this email did not arrive through the district email system. It was likely clicked in personal email or another non-email application.

  

**Continued Stealth Email Phishing**

The stealth email campaign described in our last Phish Wire has continued to target Texas districts the week of October 14th, with at least 6 users clicking on a link that redirected from the same minerva.maine.edu website. This campaign stands out due to its use of (1) compromised third-party domains, (2) Cloudflare user verification, and (3) multiple redirects. Taken together, these tactics make the phishing campaign remarkably difficult to catch via email security.

The following example illustrates a compromised third-party website: an Indian manufacturing site. The domain itself goes to the legitimate company website, while adding ‘/dist’ to the URL leads to a dangerous phishing site, starting with a Cloudflare verification.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXdFV-hPIx_EZIDRcaXdJwGzF8FjdvPeZ4JiSmiSDNBx9WfAv65Tixc2KXkGi2KIcviYErqRS54Oo9P5Ln4BM0mqRLzx_8n3jXQA4qMI6nkx2deBv8l6ajwy9MWRufG2ud5jXrgk5mGgmhBz4Yu4bHj1Xqfw?key=_9AEd6Hf-89JD29XLSSrFg)

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXej7ql2tJhD4O4uxseZdoGu_-umpoeqdXKviuRJbJjG_kYzHC8TZtvMTGOVsvnCMoYOGDeBCljw9OOwG0JmmoruELw92k2tM1weTJDM4JHI_u17Auvd1NLM2d5TfgAls6z3gsgpo8KnAJWEBfdPljnsAOaK?key=_9AEd6Hf-89JD29XLSSrFg)

**Actions**

- Remember to add these domains to your block lists, spam filters, and web content filters
- Focus awareness efforts on high-risk credentials (staff and students)
- Deploy [PhishID](https://www.identityautomation.com/products/phishing-protection) to protect credentials from targeted spear phishing campaigns
- Prioritize phishing awareness efforts for high-priority staff
- Educate users that multi-factor authentication is not a phishing panacea
- Encourage users to double-check the domain even if the page is requesting a multi-factor one-time-password