Poor old Manage My Health users cannot catch a break. Straight on the heels of the Privacy Commissioner releasing his final report on the initial breach, scammers are targeting MMH users in a phishing campaign aimed at collecting the users credit card information using the lure of a $75 refund.
Multiple websites have appeared as part of this campaign, be it core ones hosting the malicious login and credit card collection pages or compromised domains redirecting users to these domains.
Either a lot of work or a lot of AI has gone into this campaign. Luckily it does not appear to have any verification of user login details eliminating the fear the people behind it are using legitimate usernames from the initial Manage My Health breach.
All the core hosting URLS (not counting redirect pages) have so far had /mmcnz/ in the URL though we are actively hunting to see if this is apparent through all the domains. At this stage the domains used appear to be a mixture of newly registered domains and existing compromised domains, again emphasizing the amount of effort behind this campaign.
IOCs
service.jhaatmera[.]com
verodecor[.]vn
pmesmart.co[.]uk
s1285368.ha009.t.mydomain[.]zone
