A "Secure DNS" Scam: an Upgrade that's a Downgrade



secure dns scamA phishing campaign is targeting website owners with convincing, personalized emails that purport to come from WordPress, Naked Security reports. The emails claim that WordPress is upgrading the recipient’s domain to use DNSSEC (Domain Name System Security Extensions). The message has minimal spelling and grammatical errors, and it contains real explanations (copied from ICANN’s website) of what DNS and DNSSEC are. Naked Security notes that many website operators will most likely have heard of DNSSEC, and they probably know that it’s a good security measure.

“On the other hand, you’ve probably never set up DNSSEC or used it directly yourself, because it has typically been a feature used by service providers to help to keep their own DNS databases intact when they exchange data with other DNS servers,” Naked Security says. “In other words, activating DNSSEC for the server names that your hosting provider looks after for you certainly sounds like a good idea. So we can understand why some recipients of this scam might click through in order to learn more.”

The emails contain a link that’s tailored to each recipient. In Naked Security’s case, the link said, “Click here and activate DNSSEC to nakedsecurity.sophos.com.” If the recipient clicks the link, they’ll be taken to a phishing page that convincingly spoofs a WordPress login page. The page specifically says “Admin Area” to convince the user to enter their administrative credentials, which will be sent to the attackers.

While this scam was tailored to WordPress users (since Naked Security is hosted on WordPress), Naked Security found an image directory on the phishing site that contained the banner logos of 97 other hosting providers, including Akamai, HostGator, Linode, Magento, and Microsoft. The link in the email is customized so that users of different hosting providers will see the login page specific to their provider.

New-school security awareness training can enable your employees to be suspicious anytime they’re asked to enter their credentials.

Naked Security has the story: https://nakedsecurity.sophos.com/2020/06/29/beware-secure-dns-scam-targeting-website-owners-and-bloggers/


Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-security-test-offer

Subscribe To Our Blog


Ransomware Has Gone Nuclear Webinar




Get the latest about social engineering

Subscribe to CyberheistNews