Cut-and-Paste Phishbait

Library_SpearPhishingNaked Security describes a phishing campaign that’s convincingly spoofing emails from the online payment company Stripe. The email informs the recipient that an unknown device has logged into their account from an IP address in Tbilisi, Georgia, and it includes a link for the user to update their password. The attackers are using the same text and formatting contained in legitimate password reset emails, and there are few visible signs that the email is fake.

The phishing site looks slightly different from Stripe’s real login page, but most people wouldn’t notice the difference unless they looked at them side by side.

What’s significant about this campaign, however, is how quickly it was set up. Naked Security received the email just 39 minutes after the phishing site’s domain was registered. The site’s SSL certificate had also been obtained the same day. This means the attacker set up the entire site and began churning out phishing emails in under 40 minutes. Cut-and-paste phishbait, it seems, scales.

This is one of the areas where security technology can’t stay ahead of the criminals. In recent years, security companies have substantially improved their ability to detect and flag malicious sites, and many phishing sites are taken down within twenty-four hours after they go live. As this case shows, however, criminals have adapted and are now incredibly fast at standing up new phishing sites.

Naked Security says users can avoid this form of attack by never clicking on login links in emails. You should instead navigate to the site with your browser or app and log in to your account. If there’s really an issue with your account, you’ll be able to take care of it from there.

No matter how effective technical defenses become, criminals will always find a way to get to the human target. New-school security awareness training can address this problem by teaching your employees how to follow security best practices.

Naked Security has the story:

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews