In late June, Naked Security received a scam email that pretended to originate from WordPress.com. It leveraged this cover to inform the recipient that their website was eligible to receive security upgrades under the Domain Name System Security Extensions (DNSSEC). The message provided a short overview of DNSSEC and how it factored into the growth of the internet over time.
When the recipient clicked on the email’s embedded link, they found themselves redirected to a landing page masqueraded as a “WordPress Update Assistant.” This page prompted the recipient to log into their WordPress account so that they could allegedly receive the new security features on their domain. The page included logos and icons that matched the recipient’s service provider. It also included a “How to use this assistant” button.
Upon receiving their authentication credentials, the scam informed its victim that it would redirect them to the website. Instead, the ruse sent them to a 404 error message and redirected them to a URL that included the malicious actors’ domain name followed by the victim’s domain name.
Other Interesting Attack Lures
This scam email wasn’t the only attack campaign that leveraged interesting lures between March and June. At the end of June 2020, Cofense discovered a phishing scam with attack emails that used the subject line “Fraud Detection from Message Center.” The email accounts compromised belonged to a school district. Those emails warned the recipients that a security team had detected suspicious activity on their bank accounts. In actuality, the attack emails arrived with a .ICS calendar attachment that included a link hosted on Sharepoint. This link ultimately redirected a user to a phishing site hosted on Google designed to steal banking data.
A few days later, Group-IB came across a multi-stage attack campaign that began with a text message. The message claimed the sender was a recognized media outlet. It also contained a shortened link that redirected people to a fake blog post from that same media organization. Those pages used fake celebrity endorsements to trick the target into clicking anywhere on the page. If the user clicked, the page redirected them to a website hosting a bitcoin investment scam.
On July 1, Cybereason came across a FakeSpy campaign. That operation began with an SMS phishing message that appeared to come from a post office located near a target. Those messages contained “delivery updates” which brought users to a website to lure them into downloading a local postal app. That app turned out to be an Android application package for the FakeSpy Android mobile malware.
That same day, Grantham Journal revealed that malicious actors had begun circulating a scam on Facebook. The ploy claimed that a girl had disappeared in downtown Grantham, a town in Lincolnshire, United Kingdom. It urged people to share the post in an attempt to find her. The post attempted to steal users’ Facebook account credentials by redirecting them to a fake login page for the social media site.
How to Defend Against Attacks Using Unusual Lures
These attacks highlight the need for organizations to defend against attack campaigns that use unusual lures. Organizations should invest in a security awareness campaign that seeks to educate the workforce about social engineering techniques. The operation should seek to explore the use of tactics in phishing and other attack operations for the purpose of tricking their victims. Organizations also should develop training modules to teach users about what to avoid, including clicking on embedded links within emails and unsolicited text messages or email attachments from unknown sources. Finally, they should consider using email banners to warn recipients when an incoming message originates from an external source.
Malicious actors are always adding new tactics to their arsenal. Acknowledging these scams and regularly testing employees. will help keep team familiar with emerging attack techniques.