Home Depot Halloween phish gives users a fright, not a freebie

Home Depot Halloween phish gives users a fright, not a freebie reports a timely phishing email that claimed recipients had won a Gorilla Carts dump cart, delivering the offer via a single-click image that hid multiple traps. The sender domain yula[.]org is not related to Home Depot and is linked to a Los Angeles high school, suggesting the account may be compromised and the incident has been reported to the school.

The message also used Unicode whitespace and control characters to bypass filters, and a tracking pixel hosted on soundestlink[.]com in the Omnisend infrastructure was employed to monitor opens.

The clickable image directs victims through a chain of redirects—from streetsofgold.co[.]uk, which appears compromised, to bluestarguide[.]com and outsourcedserver[.]com—before landing on a fake Home Depot landing page that asks for personal and payment details after a short survey and a purported, and now escalating, processing fee.

IOCs include several domains such as sweepscraze[.]online, prizewheelhub[.]com and quelingwaters[.]online, underscoring the campaign’s multi-stage nature; according to Malwarebytes, the aim is to harvest data for phishing or identity theft.