September 23, 2020 By David Bisson 3 min read

Threat actors have no want of creativity when it comes to phishing scams. They look for new lures, new subjects and new targets as a means of preying upon organizations and users.

Fortunately, researchers are well aware of this stream of attacks that go beyond phishing emails. Many security professionals spend their time unraveling these advancements in order to keep organizations and users safe. That explains why so many phishing attacks end up making headlines for their methods and how they were caught.

Here are overviews of the techniques used in four notable phishing attacks in the second half of August 2020.

1. Canva Abused for Hosting Files

On Sunday, August 16, KnowBe4 revealed it had come across a phishing email that spoofed a file sharing notification from Sharepoint. This email instructed the recipient to click on an ‘Open’ button embedded in the email.

Once clicked, that button redirected the user to a document or file hosted on graphic design platform Canva. This item prompted the visitor to click on an ‘Access Your Secure Document’ hyperlink. In the event the visitor complied, the attack sent them off to a spoofed Sharepoint login page hosted on Weebly.

2. Corporate VPNs Targeted by Vishers

A few days later, KrebsonSecurity.com disclosed an investigation into a group of phishers-for-hire using vishing, or voice fishing. At the time of reporting, this group had primarily targeted organizations in financial, telecommunications and social media sectors.

The attacks launched by the threat group were unique in that they all started with phone calls to employees working at a targeted organization. In those calls, the attackers masqueraded as someone from IT and informed the employee they were troubleshooting some issues with the organization’s corporate VPN. The malicious actors used that ruse in an attempt to trick the employee into divulging their credentials. This could be done verbally over the phone or by visiting a phishing site created for the attacks.

3. Brokers’ Info Stolen to Create Phishing Websites

The Financial Industry Regulatory Authority (FINRA) published Regulatory Notice 20-30 on August 20. FINRA explains it received several reports from members’ firms indicating fraudsters used representatives’ information to create fake websites. Most commonly, those websites used a targeted representative’s name as the domain. They also included a picture of the representative along with details about their employment history.

Those responsible for creating these imposter sites didn’t stop there. Per FINRA’s bulletin, the fraudsters created contact forms that prompted visitors to submit their personal information including their names, email addresses and phone numbers. FINRA also said that it received reports of fraudsters having called customers and directed them to visit the fake sites.

4. Low-Key Scam Targeting Employees’ OWA Credentials

Around that same time, Sophos came across a ‘low-key’ phishing scam campaign. This operation began with an attack email that appeared to be an automated message from their own email account. This message informed them that several incoming messages had failed to arrive in their inbox. It then prompted them to visit a company-assigned Outlook Web Access (OWA) portal by clicking on a link that included the company’s name in the URL.

The only problem was the link contained a different destination than what was displayed in the hyperlinked text. Instead, it redirected the user to a temporary cloud web storage URL hosting a fake OWA login portal. Upon receiving a user’s credentials, the attack sent the victim to a legitimate OWA page.

How to Defend Against Phishing Scams

The attacks described above highlight the need for organizations to defend against phishers. They can do this by preventing users from accessing high-value assets, unless they’re critical to their work, and monitoring user behavior for suspicious activity. Simultaneously, they should test their employees’ awareness of phishing attacks on an ongoing basis as well as continuously monitor for and proactively purchase typo-squatting domains that might be impersonating their web resources.

More from

CISA hit by hackers, key systems taken offline

3 min read - The Cybersecurity and Infrastructure Security Agency (CISA) — responsible for cybersecurity and infrastructure protection across all levels of the United States government — has been hacked.“About a month ago, CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses,” a CISA spokesperson announced.In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed…

Cloud security evolution: Years of progress and challenges

7 min read - Over a decade since its advent, cloud computing continues to enable organizational agility through scalability, efficiency and resilience. As clients shift from early experiments to strategic workloads, persistent security gaps demand urgent attention even as providers expand infrastructure safeguards.The prevalence of cloud-native services has grown exponentially over the past decade, with cloud providers consistently introducing a multitude of new services at an impressive pace. Now, the contemporary cloud environment is not only larger but also more diverse. Unfortunately, that size…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today