GDPR Lure Phishing Campaign Targets Email Credentials
A phishing campaign spotted by Area 1 Security on August 31st is using GDPR compliance concerns as bait to harvest email credentials from businesses across multiple industries. The messages create a false sense of urgency by claiming the recipient's email security is not GDPR-compliant and requires immediate action. For targets unfamiliar with GDPR details, the request can easily pass as routine administrative burden rather than an attack.
The attacker uses polished graphics and formatting to make the email look authoritative, and spoofs the sender address to appear as an automated message from the target company's own security department. The "Action required" date in the message body is regularly updated to keep the lure current.
Campaign Targeting and Infrastructure
The campaign is aimed primarily at public-facing company email addresses, with some targeted attempts against executives and upper management, particularly those in sales roles who likely handle client data and GDPR compliance obligations.
The first wave of phishing messages originated from 103[.]22[.]183[.]95, a VPS IP address belonging to ReadyIDC. Using a VPS gives the attacker anonymity and lets them quickly spin up new servers if their IP gets flagged. A header review of early messages exposes a flaw: while the visible FROM header was successfully spoofed, the envelope MAIL FROM address reveals the messages were sent through a Gmail account.
MAIL FROM:<redacted>@gmail.com>
From: noreplysecurityservices@<targeted company’s domain>
To: <public-facing targeted company’s email account>
Subject: User account security alert
Date: 31 Aug 2020 22:17:43 +0700Later waves corrected this by spoofing both the visible From address and the envelope MAIL FROM domain. However, those stealthier messages included a "Disposition-Notification-To" header indicating read receipts were enabled, which again disclosed the same Gmail sender account when a target opened the email.
By September 1st, the attacker had added SMTP HELO commands that made receiving mail servers believe messages came from the target's domain. The second wave used IP address 196[.]53[.]250[.]243, which hosts a vulnerable gaming site called Ran Smok that links to pages returning "Access denied." The IP has been linked to numerous suspicious sites over time and has port 25 (SMTP) running in a filtered state, alongside other services that should never be exposed to the internet.
Credential Harvester Payload
The malicious link points to hxxps://www[.]techgaia[.]com/wp-content/email/ID/sign_in/dc0b80571c76818f4f5916ff6668eyrtsaaadaf8/completesrvr/verification/Src/?email=, hosted on a compromised WordPress site. The URL's "email" parameter is customized per recipient, and the landing page's HTML form autopopulates the username field using that parameter. After a victim enters a password and clicks "Next," the page returns an error regardless of the password's validity. Stolen credentials are sent to a script at hxxps://www[.]techgaia[.]com//wp-content/email/ID/sign_in/dc0b80571c76818f4f5916ff6668eyrtsaaadaf8/completesrvr/verification/Src/l0gin[.]php.
The www[.]techgaia[.]com domain belongs to a defunct IT consulting firm and was running WordPress 4.9.7, an outdated version vulnerable to known exploits. Its content has since been removed and the domain now redirects via HTTP 301. The site's historic legitimacy allowed the attacker to bypass basic reputation checks. Given how easily unmaintained WordPress sites are compromised, the attacker can likely resume operations on another legitimate-looking domain within days, staying ahead of deny-list-based defenses.
Mitigation Advice
Organizations handling sensitive customer data should keep employees informed about current data privacy regulations, including GDPR and newer laws like the California Consumer Protection Act. Clear communication about protocols for handling Personally Identifiable Information (PII) reduces the chance that employees will fall for phishing attacks that exploit confusion over compliance rules.
Employees also need to understand the risks of entering credentials into unsolicited login pages. However, since attackers can reproduce legitimate login pages with pixel-perfect accuracy, the more reliable defense is an email security solution that verifies messages before they reach the inbox, rather than relying on users to spot forged pages.
Indicators of Compromise
- Credential harvesters: hxxps://www[.]techgaia[.]com/wp-content/email/ID/sign_in/dc0b80571c76818f4f5916ff6668eyrtsaaadaf8/completesrvr/verification/Src/?email=
- hxxps://www[.]techgaia[.]com//wp-content/email/ID/sign_in/dc0b80571c76818f4f5916ff6668eyrtsaaadaf8/completesrvr/verification/Src/l0gin[.]php
- Sender IP addresses:
196[.]53[.]250[.]243 103[.]22[.]183[.]95
