July 14, 2020 By David Bisson 3 min read

In late June, Naked Security received a scam email that pretended to originate from WordPress.com. It leveraged this cover to inform the recipient that their website was eligible to receive security upgrades under the Domain Name System Security Extensions (DNSSEC). The message provided a short overview of DNSSEC and how it factored into the growth of the internet over time.
When the recipient clicked on the email’s embedded link, they found themselves redirected to a landing page masqueraded as a “WordPress Update Assistant.” This page prompted the recipient to log into their WordPress account so that they could allegedly receive the new security features on their domain. The page included logos and icons that matched the recipient’s service provider. It also included a “How to use this assistant” button.

Upon receiving their authentication credentials, the scam informed its victim that it would redirect them to the website. Instead, the ruse sent them to a 404 error message and redirected them to a URL that included the malicious actors’ domain name followed by the victim’s domain name.

Other Interesting Attack Lures

This scam email wasn’t the only attack campaign that leveraged interesting lures between March and June. At the end of June 2020, Cofense discovered a phishing scam with attack emails that used the subject line “Fraud Detection from Message Center.” The email accounts compromised belonged to a school district. Those emails warned the recipients that a security team had detected suspicious activity on their bank accounts. In actuality, the attack emails arrived with a .ICS calendar attachment that included a link hosted on Sharepoint. This link ultimately redirected a user to a phishing site hosted on Google designed to steal banking data.

A few days later, Group-IB came across a multi-stage attack campaign that began with a text message. The message claimed the sender was a recognized media outlet. It also contained a shortened link that redirected people to a fake blog post from that same media organization. Those pages used fake celebrity endorsements to trick the target into clicking anywhere on the page. If the user clicked, the page redirected them to a website hosting a bitcoin investment scam.

On July 1, Cybereason came across a FakeSpy campaign. That operation began with an SMS phishing message that appeared to come from a post office located near a target. Those messages contained “delivery updates” which brought users to a website to lure them into downloading a local postal app. That app turned out to be an Android application package for the FakeSpy Android mobile malware.
That same day, Grantham Journal revealed that malicious actors had begun circulating a scam on Facebook. The ploy claimed that a girl had disappeared in downtown Grantham, a town in Lincolnshire, United Kingdom. It urged people to share the post in an attempt to find her. The post attempted to steal users’ Facebook account credentials by redirecting them to a fake login page for the social media site.

How to Defend Against Attacks Using Unusual Lures

These attacks highlight the need for organizations to defend against attack campaigns that use unusual lures. Organizations should invest in a security awareness campaign that seeks to educate the workforce about social engineering techniques. The operation should seek to explore the use of tactics in phishing and other attack operations for the purpose of tricking their victims. Organizations also should develop training modules to teach users about what to avoid, including clicking on embedded links within emails and unsolicited text messages or email attachments from unknown sources. Finally, they should consider using email banners to warn recipients when an incoming message originates from an external source.

Malicious actors are always adding new tactics to their arsenal. Acknowledging these scams and regularly testing employees. will help keep team familiar with emerging attack techniques.

More from

Widespread exploitation of recently disclosed Ivanti vulnerabilities

6 min read - IBM X-Force has assisted several organizations in responding to successful compromises involving the Ivanti appliance vulnerabilities disclosed in January 2024. Analysis of these incidents has identified several Ivanti file modifications that align with current public reporting. Additionally, IBM researchers have observed specific attack techniques involving the theft of authentication token data not readily noted in current public sources. The blog details the results of this research to assist organizations in protecting against these threats. Key Findings: IBM research teams have…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

How I got started: Cyber AI/ML engineer

3 min read - As generative AI goes mainstream, it highlights the increasing demand for AI cybersecurity professionals like Maria Pospelova. Pospelova is currently a senior data scientist, and data science team lead at OpenText Cybersecurity. She also worked at Interest, an AI cybersecurity company acquired by MicroFocus and then by OpenText. She continues as part of that team today.Did you go to college? What did you go to school for?Pospelova: I graduated with a bachelor’s degree in computer science and a master’s degree…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today