As cited
Copy frozen at (site build).
threat intel
Ask Huntress: Fake .XPS Invoice Leading to Credential Phishing
A phishing campaign is distributing fake invoices with .XPS file attachments to trick recipients into opening files that lead to credential theft. The attackers use standard payment request social engineering tactics to increase the likelihood of engagement.
Why it matters: Organizations using file-based email workflows are at risk from this low-tech but effective attack vector; practitioners should educate users to verify invoice authenticity through out-of-band channels and block or scrutinize .XPS attachments.
- Source published
- First seen by Cybersecurity Tracker