Tag Archives: Phishing

There is a new phishing campaign to keep a watchful eye on according to email security firm INKY. It’s a particularly fiendish one.

The attackers have designed an email template that does an admirable job of imitating the look and feel of emails sent from the US Department of Labor.

These are being sent out to recipients asking them to submit bids for an ongoing DOL project with the specifics of the project varying from one email to the next.

The emails are professionally and meticulously arranged. Thanks to some clever spoofing they appear to come from an actual Department of Labor server. Naturally they do not come from the DOL, and there are no ongoing projects that require the Department of Labor to blindly spam out emails seeking bids.

Nonetheless, an unwary recipient could easily be taken in by the scam and click the “Bid” button embedded in the email.  That button is of course masking a malicious link which will take the email recipient to one of the phishing sites controlled by the scammers.

Like the emails themselves, these spoofed sites look completely legitimate. A comparison of the HTML and CSS on the scam sites with the actual Department of Labor reveals that they have identical code behind them which is clear evidence that the scammers scraped those sites and used the code to create their own copies.

What’s different is the fact that the scam site includes a pop-up message that is there seemingly to guide the email recipient through the bidding process.  What it’s really doing is moving the potential victim closer to giving up his or her Office 365 credentials.

Of interest is that after a victim enters his/her credentials they’ll be prompted to enter them a second time.  This is to minimize the risk of the scammers harvesting mis-typed credentials.  They seem to have thought of everything!

There’s no good defense against this except for vigilance and mindfulness so please make sure your employees, friends, and neighbors are aware of the ongoing campaign.

Surveys have long been a playground of hackers and scammers.

That’s true at any time of the year but it’s especially true around the Holidays when such scams seem to attract even more unwitting victims.  In fact, some estimates place scammer profits revolving around fake surveys as being nearly $80 million a month. So it’s big business for them.

The particulars vary somewhat from one operation to the next.

Here’s how they work in general:

First the scammer targets a perfectly legitimate survey or giveaway offered by a big well-known company or brand.

They’ll copy the layout and format of this legitimate survey creating their own version of it.  By all outward appearances from the perspective of a visitor to the survey site, they’re taking advantage of a legitimate offer.

Naturally there are some telltale signs.  Most of these fake sites aren’t checked closely for quality control so you’re likely to catch spelling errors or grammatically incorrect phrases that could serve to give away the game. Of course there’s no hiding the URL but most of the people who land on a survey or giveaway page aren’t paying much attention to that.

Once on the page the victim is in the funnel. The survey proceeds as you’d expect with a request for personal information at the end.  Sometimes they ask for a credit card (which the victim is assured won’t be billed – it’s merely being used for ‘verification purposes.’)

And you know how the story ends.

Armed with this freshly gleaned information the scammers make off with it either running up big bills on the victim’s card or selling the data to the highest bidder.

This is a global issue.  It impacts people from all walks of life and from almost every country on the planet.  Don’t fall for it.  Do your due diligence or just say no to anything that looks like it’s too good to be true.