Phishing campaigns are very common today, we receive many phishing attempts per day. Why attackers are still flooding our mailboxes with such emails? Because it sill works, and the "return on investment" of sending millions is reached even if only a few victims are lured. However, attackers are always looking for new techniques to make people confident that the message is legit. Many phishing campaigns are pretty well prepared, and the fake mail you receive looks exactly like an official one. Multiple times, I was pretty close to click on a link... Yes, we are all poor humans!

Another technique used by attackers is to try to make the victim scared and increase stress. When we are under stress, we are prone to make wrong decisions! That's the technique used by a phishing campaign that I spotted yesterday. 

If the victim follows the provided link, a message will ask the user to update his/her email account within 24h (a counter is running), but the funny fact is that the page displays a fake real-time list of disabled accounts. The list is generated with an HTML <marquee> tag:

<marquee align="center" style="height:120px; width:320px;" behavior="scroll" scrollamount="20" scrolldelay="0" direction="up">
<font face="arial" size="1" color="#FFF">
<font color="#67CC24">root@john@victim.com-server</font>:~# deleting... estellita68@john@victim.com... <br>
<font color="#67CC24">root@john@victim.com-server</font>:~# deleting... an-rickard@john@victim.com... <br>
<font color="#67CC24">root@john@victim.com-server</font>:~# deleting... mainhouseantiqu@john@victim.com... <br>
<font color="#67CC24">root@john@victim.com-server</font>:~# deleting... gfyeatonantiques@john@victim.com... <br>
<font color="#67CC24">root@john@victim.com-server</font>:~# deleting... lizabelstreasure@john@victim.com... <br>
... (Long list of fake email addresses) ...
</font>
</marquee>

Note that this tag is deprecated[1] but is still supported by most browsers.

Here is how it looks:

If you are located in the United States, Happy Thanksgiving! But keep an eye on your systems because the long weekend (tomorrow is also Black Friday!) is a good opportunity for bad guys to launch waves of attacks...

[1] https://www.w3docs.com/learn-html/html-marquee-tag.html

Xavier Mertens (@xme)
Xameco
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key