Headline Finding
This week the story is clear: credential-theft phishing continues to punch above its weight. Of 22 emails analyzed, 5 were credential-theft attempts (23% of mail threats) and one more delivered malware — a suspicious detonation (sha256: live_test_5130a0e63ad54cabb2f201f8d796b00c). Attackers are leaning on account recovery and invoice lures to harvest creds and pivot into SSH-accessible systems.
Notable Email Campaigns & Lures
- Top lure families: invoice (3 occurrences), account_recovery (2), payroll (1). Invoice-themed scams kept coming, often spoofing internal or vendor communications.
- Impersonated brands called out in samples: Jazlyn Baumbach, HIT Equipment / Hit-equipment, Microsoft, Holakos — each observed once. These are the names adversaries leaned on to seed trust.
- Notable malicious subjects we saw this week include:
- "FW: HIT-IN-2511-CUJ Contract Renewal Notice Hit-equipment" (malware, risk_score 78)
- "FW: Please Accept: Renewal Terms_692291 HIT1459" (credential_theft, risk_score 78)
- "FW: Reset your password for holakos-bf98c" (credential_theft, risk_score 85)
- Long obfuscated subject starting with "FW: 7BsChsn5rV-..." (credential_theft, risk_score 85)
- "FW: Webinar panelist invite: Unauthorized Apple Pay Transaction via WorldRemit" (credential_theft, risk_score 78)
We recommend treating any unexpected password reset, renewal, or invoice email as suspicious — especially when combined with a document link or a login prompt.
Honeypot Takeaways
The honeypot had heavy activity this week: 136,073 total events from 2,092 unique IPs and 24,162 sessions. The attacker toolset is loud and focused:
- Top protocols observed:
- ssh: 102,914 events — by far the dominant protocol
- smb: 25,151
- http: 4,734
- telnet: 1,851
- Top source countries by event count: SG (47,124), FR (23,778), US (20,145), NL (3,065), MY (565)
- Top attacking IPs (event counts): 167.99.72.161 (27,094), 207.180.211.173 (17,502), 43.110.32.33 (11,735), 165.22.54.16 (11,304), 54.82.2.151 (9,288)
The disproportionate SSH volume aligns with captured credentials data: SSH accounted for 414 of 453 credentials captured. That’s not a coincidence — adversaries are spraying SSH and collecting creds to weaponize later.
Detonations & Files
- Files detonated: 3 total. Verdicts: 2 timeouts, 1 suspicious (detonation_id: 5130a0e63ad54cabb2f201f8d796b00c, sha256: live_test_5130a0e63ad54cabb2f201f8d796b00c).
- No URLs were detonated this week.
Timeouts remain a nuisance — they can hide true behavior. Treat timed-out detonations as potentially malicious until proven otherwise.
Credentials Landscape
- Total credentials captured: 453.
- Top protocols where creds were harvested: ssh (414), mysql (34), http (2), postgresql (2), ftp (1).
That concentration in SSH access is an urgent signal: prioritize monitoring and hardening of SSH endpoints, enforce keys over passwords where possible, and rotate any exposed credentials immediately.
By The Numbers
- Period: Week of March 4-10, 2026
- Emails analyzed: 22
- Safe: 15
- Phishing: 1
- Credential theft: 5
- Malware: 1
- Honeypot events: 136,073
- Unique attacker IPs: 2,092
- Sessions: 24,162
- Top honeypot protocols: ssh (102,914), smb (25,151), http (4,734)
- Top source countries: SG (47,124), FR (23,778), US (20,145)
- Top source IPs: 167.99.72.161 (27,094), 207.180.211.173 (17,502), 43.110.32.33 (11,735)
- Credentials captured: 453 (ssh 414)
- Files detonated: 3 (1 suspicious, 2 timeout)
Recommendations
- Treat invoice and account-recovery emails as high-risk. Verify out-of-band before clicking links or submitting credentials.
- Harden SSH: disable password auth where possible, require keys and 2FA, and monitor failed/successful login spikes tied to the top IPs listed above.
- Investigate any timed-out detonations as suspicious — consider sandbox diversity or re-submit with different settings.
Closing / CTA
See something weird? Forward suspicious emails to submit@blackdome.ai. Want this data programmatically? Check the BlackDome API for feeds, IOCs, and automated analysis.