Threat actors have no want of creativity when it comes to phishing scams. They look for new lures, new subjects and new targets as a means of preying upon organizations and users.
Fortunately, researchers are well aware of this stream of attacks that go beyond phishing emails. Many security professionals spend their time unraveling these advancements in order to keep organizations and users safe. That explains why so many phishing attacks end up making headlines for their methods and how they were caught.
Here are overviews of the techniques used in four notable phishing attacks in the second half of August 2020.
On Sunday, August 16, KnowBe4 revealed it had come across a phishing email that spoofed a file sharing notification from Sharepoint. This email instructed the recipient to click on an ‘Open’ button embedded in the email.
Once clicked, that button redirected the user to a document or file hosted on graphic design platform Canva. This item prompted the visitor to click on an ‘Access Your Secure Document’ hyperlink. In the event the visitor complied, the attack sent them off to a spoofed Sharepoint login page hosted on Weebly.
A few days later, KrebsonSecurity.com disclosed an investigation into a group of phishers-for-hire using vishing, or voice fishing. At the time of reporting, this group had primarily targeted organizations in financial, telecommunications and social media sectors.
The attacks launched by the threat group were unique in that they all started with phone calls to employees working at a targeted organization. In those calls, the attackers masqueraded as someone from IT and informed the employee they were troubleshooting some issues with the organization’s corporate VPN. The malicious actors used that ruse in an attempt to trick the employee into divulging their credentials. This could be done verbally over the phone or by visiting a phishing site created for the attacks.
The Financial Industry Regulatory Authority (FINRA) published Regulatory Notice 20-30 on August 20. FINRA explains it received several reports from members’ firms indicating fraudsters used representatives’ information to create fake websites. Most commonly, those websites used a targeted representative’s name as the domain. They also included a picture of the representative along with details about their employment history.
Those responsible for creating these imposter sites didn’t stop there. Per FINRA’s bulletin, the fraudsters created contact forms that prompted visitors to submit their personal information including their names, email addresses and phone numbers. FINRA also said that it received reports of fraudsters having called customers and directed them to visit the fake sites.
Around that same time, Sophos came across a ‘low-key’ phishing scam campaign. This operation began with an attack email that appeared to be an automated message from their own email account. This message informed them that several incoming messages had failed to arrive in their inbox. It then prompted them to visit a company-assigned Outlook Web Access (OWA) portal by clicking on a link that included the company’s name in the URL.
The only problem was the link contained a different destination than what was displayed in the hyperlinked text. Instead, it redirected the user to a temporary cloud web storage URL hosting a fake OWA login portal. Upon receiving a user’s credentials, the attack sent the victim to a legitimate OWA page.
The attacks described above highlight the need for organizations to defend against phishers. They can do this by preventing users from accessing high-value assets, unless they’re critical to their work, and monitoring user behavior for suspicious activity. Simultaneously, they should test their employees’ awareness of phishing attacks on an ongoing basis as well as continuously monitor for and proactively purchase typo-squatting domains that might be impersonating their web resources.
David Bisson is an infosec news junkie and security journalist. He works as Contributing Editor for Graham Cluley Security News and Associate Editor for Trip...read more
08 May, 2021  0  Comments
A malicious email can look just like it comes from a financial institution, an e-commerce site, a government agency or any other service or business.
It often urges you to... ...Read More
01 Mar, 2021  1  Comments
Cybersecurity issues are a looming threat to businesses. Recent trends suggest that malicious attacks are on the rise, with more breached data... ...Read More
01 Mar, 2021  0  Comments
Nowadays the cyber security is essential for individuals, companies, economies, governments and nations as a whole. The reality is that all of them are trying to stay on track against the... ...Read More
23 Feb, 2021  0  Comments
In today’s digital world, people are trading convenience for privacy – which means they’re sharing more and more information about themselves. While we can all appreciate... ...Read More
Sign up to receive our free newsletters!
We do not spam. We value your privacy!
© 2020 Just40days.com. All Rights Reserved. Developed by HariOm Technologies