An evolution in phishing attacks now leverages popular businesses and services to infiltrate people’s inboxes.
Named “Phishing Scams 3.0”, this method involves attackers using actual legitimate services to execute their attack, according to Check Point Software company Avanan.
In such scams, the victim receives an email from a totally legitimate service, such as PayPal or Google Docs, that includes a link to a malicious site.
Cybercriminals have been impersonating PayPal, Google Docs, Sharepoint, Fedex, Intuit, iCloud and more.
How it works is that the hacker creates a free account in Paypal (for example), then finds email addresses to send to. The hacker creates a fake invoice that either says the user has been charged or something is about to renew, and clicks send.
In the past two months of February and March, Avanan researchers have seen a total of 33 817 email attacks impersonating legitimate, popular firms and services.
Jeremy Fuchs, spokesperson at Avanan, says: “Business email compromise (BEC) attacks have evolved again. A traditional BEC attack relies upon the ability to look like someone with power within a company or a trusted external partner.
“Later on, attacks shifted to a method in which the attacker compromises an account, belonging to an organisation or one of his partner’s organisations, and uses it to insert themselves into legitimate email threads, responding as if they were employees.
“Now we’re seeing something entirely new, where attackers are using actual legitimate services to carry their attack. In such scams, the victim receives an email from a totally legitimate service (for example: PayPal, Google Docs) which will include a link to a malicious site.
“In the past two months of February and March, our researchers have seen a total of 33 817 email attacks, impersonating legitimate, popular firms and services. We call these new style of cyberattacks ‘Phishing Scams 3.0′, or BEC Firm Impersonation.
“It is important to note that there is nothing malicious with these popular sites, nor is there a vulnerability. Instead, hackers are using these services’ legitimacy to gain entry into the inbox. I strongly urge folks to implement two-factor authentication and use email filters to protect themselves from these style of attacks.”