← Back to Feed

Beware of Phishing Emails That Disguise Themselves as Project Material Purchase Requests

September 27, 2026 · AhnLab ASEC · Severity: MEDIUM

AhnLab ASEC identified a phishing campaign where emails disguised as project material purchase requests impersonate Korean company employees. The emails contain a malicious XLS attachment that, when opened, compromises the recipient's system. 📌 **Analyst Note:** This campaign is a classic business email compromise variant targeting procurement departments. Organizations should enforce strict attachment scanning and verify unexpected purchase requests through alternate channels.

Key Takeaways

  • Phishing emails impersonating employees of a Korean company are circulating, disguised as project material purchase request forms to trick recipients into opening malicious XLS attachments.
  • The attack relies on social engineering by mimicking legitimate business procurement processes, increasing the likelihood that targets will execute the attached file.
  • Once opened, the malicious XLS file likely delivers malware or steals credentials, emphasizing the need for robust email filtering and user awareness training.
☕ Buy a Coffee