Researchers at Vade warn that an email phishing campaign is informing users that their Instagram account is eligible to receive a blue verification badge. If a user clicks the link, they’ll be taken to a spoofed Instagram login page designed to steal their credentials.
“First discovered by Vade in late July, the scam exploits Instagram’s highly sought-after verification program to dupe victims into divulging personal information and account credentials,” the researchers write. “The malicious attack targets specific users of the social media platform, showing more sophistication than other phishing campaigns that pursue victims indiscriminately.”
The emails impersonate Instagram, and are tailored to each target. The phishing page URL is “teamcorrectionbadges[.]com.”
“The phishing email uses the subject line, ‘ig bluebadge info’ and the name, ‘ig-badges,’” the researchers write. “The body text explains that the victim’s Instagram profile has been reviewed and deemed eligible for verification. The Instagram and Facebook logos at the header and footer of the email attempt to create an air of legitimacy, as does the use of the victim’s actual Instagram handle, showing the hackers researched their target before the attack.”
The researchers note that observant users could recognize some discrepancies and signs of social engineering in the email.
“Other signs suggest a classic case of phishing,” the researchers write. “Grammatical errors and typos appear several times in the text—the common calling card of foreign bad actors—including the phrase, ‘Thanks, you instagram team.’ The email also urges prompt action—another hallmark of phishing and spear phishing emails—telling the victim, ‘if you ignore this message, the form will be permanently deleted within 48 hours.’”
Vade adds that Instagram requires users to apply for badges, and typically only verifies high-profile users with large followings. New-school security awareness training can teach your employees to recognize the signs of social engineering attacks.
Here's how it works:
