Scammers are targeting Instagram users with phony offers to verify their accounts in order to receive Instagram’s blue checkmark, Threatpost reports. Researchers at Sucuri came across a phishing page at “instagramforbusiness[.]info” that spoofs Instagram’s branding and asks users to provide the credentials to their Instagram account in order to receive a verified badge.
After a user enters their Instagram credentials, the site prompts them to log in to their email account as well, “to verify” that the user is who they say they are. The researchers assume the attackers need access to the victim’s email account to avoid being locked out of the stolen Instagram account.
Like on other social media platforms, Instagram’s blue checkmark is meant to be a sign of credibility for accounts belonging to high-profile people and organizations. Only around 1% of Instagram users have verified accounts, so some see it as a sign of superior social status. For more enterprising individuals, the badge also makes it much easier to monetize an account. As a result, the verification badge is a tantalizing phishing lure for platform-specific targeting.
Luke Leal from Sucuri told Threatpost that the phishing page was probably being distributed on Instagram, presumably through phony posts or direct messages. He noted that attempts to hack social media accounts are on the rise because they offer an avenue for additional, more targeted attacks.
“Phishing attacks against social media accounts continue to increase for a few different reasons, namely for its large user base and the potential source of personal information that can be stored on social media accounts (e.g. date of birth, first + last name, general location, phone number, email address) and this personal information can then be used for further malicious activity while the victim is unaware and just thinks their social media account was stolen,” said Leal.
Social engineering attacks use emotional hooks to prey on human weaknesses, but people can defend themselves if they know how attackers think. New-school security awareness training can put your employees in a mindset that’s focused on rationally assessing tempting or frightening calls to action, rather than responding impulsively.
Threatpost has the story: https://threatpost.com/scammers-prey-on-instagram-vanity-and-verified-account-status/146075/
Find out how affordable new-school security awareness training is for your organization. Get a quote now.
