PNC Bank Phishing Attack!

21 06 2010

The MS Team just came across  a new Email Phishing spoofing the PNC Bank!The PNC phishing email will route you to the spoofed PNC Bank site so they can steal your banking info.  The Phishing email tells you to restore your account!  The Spoofed Site will steal your banking info and  even send you a nice Trojan and Key-logger to capture all your personal data.

PNC is a highly diversified and growing financial services organization spanning the retail, business and corporate markets.

PNC Bank Targeted attack: hxxp://

The site is associated with the BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD registrar which is known harbor the Pharma Scam, Fake Software and Fake Rolex Sites.

<PNC Phish Sample>

From: PNC Bank []
Sent: Saturday, June 19, 2010 9:51 AM
To: <Joe SixPack>
Subject: Notice – Pnc

Dear PNC customer,

Protecting the security of our customers and the PNC, as a preventative measure, we have temporarily limited access to sensitive account features. Please take the following steps to ensure that your account has not been compromised and restore your account: “h–p://”

2010 PNC and Co, Inc. All rights reserved. Member SIPC (2009-4236090)

Malware Links h–p:// Seite h–p:// wird ge.ffnet ?O

Site Analyzed:

DNS Traffic:

  • <– Tracking cookies!

Malicious HTTP Traffic:

Request: [ GET /images/Conversion495x159WelcomeNatCityV2.swf ], Response: [ 200 “OK” ]
From  1051 to – [ ]
Request: [ GET /images/Requester_003.jpg ], Response: [ 200 “OK” ]
From ANUBIS:1052 to – [ ]
Request: [ GET /images/Requester_002.jpg ], Response: [ 200 “OK” ]
From ANUBIS:1053 to – [ ]
Request: [ GET /images/Requester_004.gif ], Response: [ 200 “OK” ]
Request: [ GET /dcsx2yobi00000w45we0xdcvj_6x2g/wtid.js ], Response: [ 200 “Ok” ]




Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: