Vane3alga    

Business
Focused
Technology

A Can of Phishbait: from Surveys to Rule Changes to Your Boss’s Boss

Employees need to continue being wary of phishing scams as they begin to return to the office, according to Roger Kay at INKY. Kay describes several phishing templates that INKY has intercepted in recent months, including one that informed recipients that they needed to fill out a compliance form related to COVID-19 risks.

“Reasonably well written, this email, apparently from the human resources department at the target company, actually came from phishers located in the United Kingdom,” Kay writes. “There are elements that might strike the recipient as strange. For example, the phrase ‘recuperating favorably’ is a bit off. Noncompliance is spelled ‘non-compliance.’ And ‘these guide and policies’ has an agreement-of-number problem. But otherwise, it’s a pretty good fake, including the legitimate SharePoint link embedded in the email. The problem with the link was that it led to a real but hijacked SharePoint site that was turned into a credential harvesting operation.”

Another phishing email purported to be sent from a company’s HR department asking all employees to take a survey regarding their interest in receiving a COVID-19 vaccine. The email contained a link to “survymonky/r/HPG23P”(spoofing the entirely legitimate and very familiar surveymonkey.com).

Kay also describes an email that appeared to come from the company’s CEO and abused an open redirect link to fool the target into thinking the link was benign.

“[E]mbedded within it was a link that used Google’s open redirect capability to send those who clicked through to a malware injection site or a credential harvesting operation,” he writes. “The cybercriminal was able to exploit a weakness that some legitimate websites like Google use that allows users to input parameters in a link that redirects to other sites. What the user sees is ‘google.com’ followed by a long URL path. Even if the recipient were to scrutinize the URL, all they’d see was a good-looking Google redirect.”

New-school security awareness training can enable your employees to recognize phishing scams and other forms of social engineering.

INKY has the story.


SOURCE: KnowBe4.com

President, Transportation Company

Your technical support team has always been able to handle our needs quickly, efficiently, and patiently. We appreciate your timeliness and the hours you have saved us. It is great to know that we have people at IT360 capable to provide solutions to our problems.

President, Transportation Company

Recent
Technology News

IT 360 News
Elevate Your Communication with IT360’s Advanced Phone Solutions

Unleash the Power of Seamless Connectivity Welcome to IT360, where cutting-edge technology meets unparalleled communication efficiency. Our advanced phone systems are expertly designed to cater to the diverse needs of modern businesses, ensuring you stay connected in today’s fast-paced world. Transform your business’s communication infrastructure into a robust, adaptable, and scalable network with our solutions, […]

Read more
IT 360 News
Integrating AI into Your Daily Work: A Practical Guide

Introduction Artificial Intelligence (AI) is revolutionizing the workplace, offering tools to enhance productivity, creativity, and decision-making. Starting with AI in your everyday work doesn’t require extensive technical knowledge. This guide provides practical steps and examples to seamlessly integrate AI into your work routine, focusing on the accessible platform chat.openai.com. Getting Started with AI Practical Uses […]

Read more