JS/Phishing.DE!tr

Analysis

JS/Phishing.DE!tr is a generic detection for a trojan.
Since this is a generic detection, malware that are detected as JS/Phishing.DE!tr may have varying behaviour.
Below are some of its observed characteristics/behaviours:

• This malware will attempt to gain access to the victim's credentials by utilizing social engineering tactics.


• Masquerading as a login page for legitimate companies, including DHL, OneDrive and Adobe, it will prompt the user to enter their login information in order to view sensitive documents.


• After the login information is entered into the phishing form, the form data will be sent to the attacker, therefore compromising the user's credentials.

Below are images of the malware:

Figure 1: Fake OneDrive login page.

Figure 2: Fake Adobe login page.

Figure 3: Fake DHL login page.

Recommended Action

• Make sure that your FortiGate/FortiClient system is using the latest AV database.
• Quarantine/delete files that are detected and replace infected files with clean backup copies.