Scammers are using fake copyright infringement warnings to trick people into handing over their Instagram credentials, Naked Security reports. The warnings arrive in emails that appear to come from Instagram and warn recipients that their accounts will be suspended if they don’t file an objection within twenty-four hours. If a recipient clicks on the link to file the objection, they’ll be taken to a phishing page that imitates Instagram’s appearance.
After a victim enters their username and password to supposedly file an appeal, they’ll see a loading page followed by a green checkmark and a message telling them their appeal has been filed. Finally, the site will redirect them to Instagram’s real login page.
Once the scammers have gained access to an Instagram account, they can use it for information gathering, monetization, or spreading additional phishing schemes to the account’s contacts.
Naked Security notes that the phishing site in this case has a long URL beginning with “instagram[.]copyrightinfringementappeal.” The use of two subdomains makes it difficult for users to see that the primary domain is fraudulent. Mobile devices are particularly susceptible to this technique, since they have less screen space to show the URL.
However, Naked Security also points out multiple red flags that could have alerted users to the fraud. First, the email and website both contained obvious typos and grammatical errors. Second, the email was sent from a Turkish hosting company and the phishing site was hosted on a “[.]cf” domain, which is the country code for the Central African Republic. Finally, a Google search could have revealed that Instagram’s copyright appeals process doesn’t actually work like this.
If someone doesn’t know to look for these red flags, however, it’s not hard to imagine them falling for this scam. New-school security awareness training can help your employees recognize signs of social engineering before they send their password to an attacker. Naked Security has the story: https://nakedsecurity.sophos.com/2019/09/24/instagram-phish-poses-as-copyright-infringement-warning-dont-click/
Here's how it's done:
