Threat actors have no want of creativity when it comes to phishing scams. They look for new lures, new subjects and new targets as a means of preying upon organizations and users.
Fortunately, researchers are well aware of this stream of attacks that go beyond phishing emails. Many security professionals spend their time unraveling these advancements in order to keep organizations and users safe. That explains why so many phishing attacks end up making headlines for their methods and how they were caught.
Here are overviews of the techniques used in four notable phishing attacks in the second half of August 2020.
On Sunday, August 16, KnowBe4 revealed it had come across a phishing email that spoofed a file sharing notification from Sharepoint. This email instructed the recipient to click on an ‘Open’ button embedded in the email.
Once clicked, that button redirected the user to a document or file hosted on graphic design platform Canva. This item prompted the visitor to click on an ‘Access Your Secure Document’ hyperlink. In the event the visitor complied, the attack sent them off to a spoofed Sharepoint login page hosted on Weebly.
A few days later, KrebsonSecurity.com disclosed an investigation into a group of phishers-for-hire using vishing, or voice fishing. At the time of reporting, this group had primarily targeted organizations in financial, telecommunications and social media sectors.
The attacks launched by the threat group were unique in that they all started with phone calls to employees working at a targeted organization. In those calls, the attackers masqueraded as someone from IT and informed the employee they were troubleshooting some issues with the organization’s corporate VPN. The malicious actors used that ruse in an attempt to trick the employee into divulging their credentials. This could be done verbally over the phone or by visiting a phishing site created for the attacks.
The Financial Industry Regulatory Authority (FINRA) published Regulatory Notice 20-30 on August 20. FINRA explains it received several reports from members’ firms indicating fraudsters used representatives’ information to create fake websites. Most commonly, those websites used a targeted representative’s name as the domain. They also included a picture of the representative along with details about their employment history.
Those responsible for creating these imposter sites didn’t stop there. Per FINRA’s bulletin, the fraudsters created contact forms that prompted visitors to submit their personal information including their names, email addresses and phone numbers. FINRA also said that it received reports of fraudsters having called customers and directed them to visit the fake sites.
Around that same time, Sophos came across a ‘low-key’ phishing scam campaign. This operation began with an attack email that appeared to be an automated message from their own email account. This message informed them that several incoming messages had failed to arrive in their inbox. It then prompted them to visit a company-assigned Outlook Web Access (OWA) portal by clicking on a link that included the company’s name in the URL.
The only problem was the link contained a different destination than what was displayed in the hyperlinked text. Instead, it redirected the user to a temporary cloud web storage URL hosting a fake OWA login portal. Upon receiving a user’s credentials, the attack sent the victim to a legitimate OWA page.
The attacks described above highlight the need for organizations to defend against phishers. They can do this by preventing users from accessing high-value assets, unless they’re critical to their work, and monitoring user behavior for suspicious activity. Simultaneously, they should test their employees’ awareness of phishing attacks on an ongoing basis as well as continuously monitor for and proactively purchase typo-squatting domains that might be impersonating their web resources.
David Bisson is an infosec news junkie and security journalist. He works as Contributing Editor for Graham Cluley Security News and Associate Editor for Trip...read more
14 Nov, 2020  0  Comments
It all sounds like a fairytale – somebody informed you that you won millions of dollars on the lottery. However, there are some conditions that you need to fulfill, and that seems... ...Read More
09 Nov, 2020  0  Comments
The year 2020 has become remarkable in many ways, especially when it comes to the surge in cyber attacks. The Covid-19 pandemic has given an unprecedented opportunity to cyber attackers to... ...Read More
07 Nov, 2020  0  Comments
The US Cybersecurity and Infrastructure Security Agency (CISA), alongside the FBI, has issued a new warning to raise awareness of heightened levels of disinformation around, and... ...Read More
What Is Cybercrime?
Cybercrime, also termed as computer crime, is nothing but an illegal activity that primarily involves a computer and network-connected device, for example, a mobile... ...Read More
Sign up to receive our free newsletters!
We do not spam. We value your privacy!
© 2020 Just40days.com. All Rights Reserved. Developed by HariOm Technologies