2018-11-06 onedrive cred phish fhengage.flu.cc

@onedrive credential #phishing kit
found by @neonprimetime

kit: https://fhengage.flu.cc/nd/Office.zip

sending ip: 51.179.144.170
sender: Christina.Davis@acquisitionbilling.com
11/5/2018
subject: Notification Recent EFT
body: Now you have new files, see of Download NOW, Thank you!

links to fake pdf: https://uprightmanagement-my.sharepoint.com/:w:/r/personal/sisbester_uprightmanagement_com_au/_layouts/15/Doc.aspx?sourcedoc=%7B5793f25b-4449-47d0-a4a4-d14c927df8a8%7D&action=default

which has a link to cred page: https://fhengage.flu.cc/nd/office/

which send stolen passwords to this threat actor: $recipient = "fndonati9@gmail.com";