Wow, got an iCloud phishing scam that is 0% on VirusTotal

[MacDefender]

VirusTotal

VirusTotal

www.virustotal.com

I just got this PDF scam saying that my iCloud account was locked. The link to "reset" my password goes to an obvious phishing scam. Unfortunately, F-Secure, Chrome, and MS Edge Chromium all happily allow me to visit the site.

The URL is in the VirusTotal link and I detected no drive-by malware from visiting the site itself through a VPN. But I found it shocking that nothing on VirusTotal detected the link.

Anyone care to test more AV software?

 

[EndangeredPootis]

Of course it is, thats the url shortener link, not the actual phishing link, and links arent often flagged by AV's, and if they are its by kaspersky, bitdefender etc.

 

[MacDefender]

VirusTotal

VirusTotal

www.virustotal.com

The full URL seems to get 3 hits. Still feels low :-/

 

[upnorth]

Good catch!

I tested the link on AnyRun and in Opera it didn't open at all, but in Chrome it connected to a site and page I recalled seen somewhere before.

Spoiler

Widespread Apple ID Phishing Attack Pretends to be App Store Receipts

A widespread and sneaky phishing campaign is underway that pretends to be a purchase confirmation from the Apple App store. These emails contain a PDF attachment that pretends to be a receipt for an app that was purchased by your account for $30 USD and tells you to click a link if the...

malwaretips.com

 

[CyberTech]

Well where did you get it from? Email?

 

[Mahesh Sudula]

G data, Trend micro, Avast, Symantec,Kaspersky have no clue about this url first case so.....FAILED !
Seems might be very very newly even just few hrs back created fake domain
NICE CATCH !

 

[MacDefender]

Well where did you get it from? Email?

Direct to my personal email! I feel so special....

 

[Mahesh Sudula]

Pls take care of your email address..it is not a good thing to receive things like this..considering the age of the host ..might be you are in top 10 list to receive this.
Hope u haven't clicked or downloaded any suspicious attachment / links like that. Disasters are beyond imagination.

 

[CyberTech]

Direct to my personal email! I feel so special....

Please read How to Easily Spot and Avoid Apple ID Phishing Scams be careful next time...

 

[MacDefender]

Pls take care of your email address..it is not a good thing to receive things like this..considering the age of the host ..might be you are in top 10 list to receive this.
Hope u haven't clicked or downloaded any suspicious attachment / links like that. Disasters are beyond imagination.

Yeah I took a look at the header, it was delivered to one of my open source aliases -- 10 years ago I was a pretty prominent open source figure with a well publicized email address.

And indeed, I took several precautions when analyzing this link. It was also embedded in a PDF which could've been an exploit vector in and of itself.

Please read How to Easily Spot and Avoid Apple ID Phishing Scams be careful next time...

Just for clarity, I was aware from the beginning that this was a phishing link. I was just curious how well the various browsing protection software out there would guard against this if I pretended to be dumb and fall into the phishing trap. It was surprising to me that the only 3 products that detected it were arguably enterprise-only.

 

[SeriousHoax]

G data, Trend micro, Avast, Symantec,Kaspersky

Adding Bitdefender, Malwarebytes, ESET to this list.

 

[oldschool]

Direct to my personal email! I feel so special....

Yes, I think I know how you feel. I got an email recently from someone informing me that they were now "following" me on Flicker.com. The funny thing is I have never uploaded any pics there. I only follow a couple of people.

 

[MacDefender]

Adding Bitdefender, Malwarebytes, ESET to this list.

Wow! So at this point it's probably like over 90% of the installed base of antimalware software that don't see something wrong.

The site itself has typos, appears pixelated (screen shots based) on my 4K display, and has a lot of "Apple" links that go to long suspicious URLs. I think we talked about some products (G DATA?) investing in machine learning / AI to recognize phishing, but that seems like it should be the right approach to detect stuff like this.

I think most of us as malware enthusiasts, we can take one look at the website and laugh about how it obviously looks fake. It seems like it should be possible to teach a browser plugin the same thing!

 

[harlan4096]

VirusTotal

VirusTotal

www.virustotal.com

The full URL seems to get 3 hits. Still feels low :-/

I'm getting this:

 

[MacDefender]

I'm getting this:

View attachment 237969

Nice! I'm guessing it was a short lived phishing site then. Wonder if the domain registrar or ISP found out.

 

[MacDefender]

Unfortunately it's still alive for me....

 

[SeriousHoax]

Hey look, now it's even blocked by even Google safe browsing. I immediately reported to all the major AVs after seeing your post including Google safe browsing but I don't think it was due to my submission. Anyway, it's blocked now by quite a few.

VirusTotal

VirusTotal

www.virustotal.com

 

[Oten]

View attachment 237970

Unfortunately it's still alive for me....

I looked at the main domain in that pic, takpernahsealam is a Malay or Indonesian language.
tak pernah = never
sealam = one world/ same world/ whole world/ unified world

Could be someone from SE Asia did it?

 

[Mahesh Sudula]

OK, SITE now added to blacklist though.

 

[mlnevese]

Just tested. The site is blocked both by Google's Safe Browsing and Microsoft's SmartScreen