Researchers at Malwarebytes warn that cybercriminals are using search engine poisoning to boost phishing pages to the top of Bing’s search results.
The researchers found when they searched “KeyBank login” in Bing, a spoofed KeyBank login page appeared above KeyBank’s official site.
“The domain name used is ixx-kexxx[.]com which was registered on November 15,” the researchers write. “Given that it is only two weeks old and yet came up before ibx.key.com (the real website), we surmise that the attackers are abusing Bing’s search algorithms.”
After clicking the link, users will be redirected to a convincingly spoofed version of KeyBank’s site, where they’ll be asked to enter their username and password. If the user complies, the site will show a “slow connectivity” message while the crooks enter the stolen credentials on KeyBank’s real site.
Notably, the criminals added a second page that asks for the user’s multi-factor authentication (MFA) code. If the user has MFA enabled, they’ll receive a prompt after the crooks attempt to log in with the stolen credentials.
While MFA offers a valuable layer of defense, people should know that attackers can still use social engineering to trick them into handing over their MFA codes.
“Multi-factor authentication is still highly recommended, but users should be aware that criminals can directly ask for verification codes while pretending to be the real bank,” Malwarebytes says.
“We should also note that SMS verification is one of the weakest methods for two-factor authentication. Security questions (usually 3 of them) are also used to either reset a password or for some other verification purpose (maybe a login from a new browser or location). This phishing kit also asks the victims to enter that information.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Malwarebytes has the story.