A phishing campaign is targeting website owners with convincing, personalized emails that purport to come from WordPress, Naked Security reports. The emails claim that WordPress is upgrading the recipient’s domain to use DNSSEC (Domain Name System Security Extensions). The message has minimal spelling and grammatical errors, and it contains real explanations (copied from ICANN’s website) of what DNS and DNSSEC are. Naked Security notes that many website operators will most likely have heard of DNSSEC, and they probably know that it’s a good security measure.
“On the other hand, you’ve probably never set up DNSSEC or used it directly yourself, because it has typically been a feature used by service providers to help to keep their own DNS databases intact when they exchange data with other DNS servers,” Naked Security says. “In other words, activating DNSSEC for the server names that your hosting provider looks after for you certainly sounds like a good idea. So we can understand why some recipients of this scam might click through in order to learn more.”
The emails contain a link that’s tailored to each recipient. In Naked Security’s case, the link said, “Click here and activate DNSSEC to nakedsecurity.sophos.com.” If the recipient clicks the link, they’ll be taken to a phishing page that convincingly spoofs a WordPress login page. The page specifically says “Admin Area” to convince the user to enter their administrative credentials, which will be sent to the attackers.
While this scam was tailored to WordPress users (since Naked Security is hosted on WordPress), Naked Security found an image directory on the phishing site that contained the banner logos of 97 other hosting providers, including Akamai, HostGator, Linode, Magento, and Microsoft. The link in the email is customized so that users of different hosting providers will see the login page specific to their provider.
New-school security awareness training can enable your employees to be suspicious anytime they’re asked to enter their credentials.
Naked Security has the story: https://nakedsecurity.sophos.com/2020/06/29/beware-secure-dns-scam-targeting-website-owners-and-bloggers/
Here's how it works:
