wetransfer.com

Phishing Download Exfiltration

Attackers can upload malicious files and share them to targets via WeTransfer's email servers. wetransfer.com validates the sender email before using it.

None

Attackers can upload data to wetransfer.com and share the link to themselves to download the exfiltrated data. Requires GUI access.

Attackers can keep their tools stored on wetransfer.com and when required, use the custom link to download.

https://www.joesandbox.com/analysis/487302/0/html