Latest Netflix-Impersonated Phishing Attacks Surge in Frequency by 78% Since October

Netflix-Impersonated PhishingUsing a mix of invisible and lookalike characters, this phishing attack attempts to get past security scanners by obfuscating both email content and domain names.

We covered a Netflix-related phishing attack earlier last month claiming the recipient’s account was suspended. According to email security vendor, Egress, this attack – and others like it – have resulted in a massive uptick in phishing attacks impersonating the on-demand video giant. Over half of attacks (52%) mention Netflix’s new ad-tier membership package to add legitimacy and drive engagement from potential victims.

According to Egress, the attackers use rare Unicode characters “that the linguistic engines of many secure email gateways (SEGs) are unable to pick up on.” Two examples given by Egress include a homograph attack where the domain is registered using international characters that look like ‘xn–’, but would be translated by a browser to ‘а’, as well as a Unicode characters used in email subjects to avoid detection by scanning engines, as shown below in an example where the characters were displayed:


Source: Egress

This level of craftiness far surpasses the typical level of attentiveness paid by a user that isn’t concerned about cyberattacks. Users need to be educated with Security Awareness Training to be in a constant state of vigilance when any unexpected email comes in. Assume it’s malicious until proven otherwise.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews