Naked Security describes a phishing campaign that’s convincingly spoofing emails from the online payment company Stripe. The email informs the recipient that an unknown device has logged into their account from an IP address in Tbilisi, Georgia, and it includes a link for the user to update their password. The attackers are using the same text and formatting contained in legitimate password reset emails, and there are few visible signs that the email is fake.
The phishing site looks slightly different from Stripe’s real login page, but most people wouldn’t notice the difference unless they looked at them side by side.
What’s significant about this campaign, however, is how quickly it was set up. Naked Security received the email just 39 minutes after the phishing site’s domain was registered. The site’s SSL certificate had also been obtained the same day. This means the attacker set up the entire site and began churning out phishing emails in under 40 minutes. Cut-and-paste phishbait, it seems, scales.
This is one of the areas where security technology can’t stay ahead of the criminals. In recent years, security companies have substantially improved their ability to detect and flag malicious sites, and many phishing sites are taken down within twenty-four hours after they go live. As this case shows, however, criminals have adapted and are now incredibly fast at standing up new phishing sites.
Naked Security says users can avoid this form of attack by never clicking on login links in emails. You should instead navigate to the site with your browser or app and log in to your account. If there’s really an issue with your account, you’ll be able to take care of it from there.
No matter how effective technical defenses become, criminals will always find a way to get to the human target. New-school security awareness training can address this problem by teaching your employees how to follow security best practices.
Naked Security has the story: https://nakedsecurity.sophos.com/2020/03/02/the-stripe-account-phish-that-unfolded-in-under-an-hour/
Here's how it works:
