New Instagram Phishing Scam Uses Familiar (But Fake) 2FA Codes to Trick Victims

Scammers use familiar verification methods to establish credibility and lull the victim into a false sense of security to compromise Instagram accounts.

This scam is brilliant. It uses a number of very familiar factors:

People are used to receiving notifications about use of their account (a good example is Google – every time you sign on anywhere new, they send you a notification email)
People are used to seeing two-factor authentication codes being sent to both phones and email.
People are relaxed about receiving emails from the social platforms they use.

Put all these together and you have the makings of a very creative scam. Researchers at security vendor Sophos spotted this scam in the wild. An email is received purportedly from Instagram stating “Someone tried to log in to your Instagram account. If this wasn’t you, please use the following code to confirm your identity.” The email then provides a six-digit code and a link to verify your credentials.

Victims are taken to a spoofed logon page, complete with an SSL certificate, and are asked to both login and provide the verification code.

It’s a clever execution of a credential harvesting scam with just the right amount of urgency, familiarity, and credibility to elicit a response from potential victims. This is a great example of just how close scammers are getting to looking like the vendors they mimic. It’s one of the reasons organizations can no longer consider quarterly or breakroom training to be enough. Users require continual Security Awareness Training specifically to elevate their sense of security while working. The scam above hopes that users won’t find it odd that they are being taken to a domain other than Instagram.com. Users that have undergone continual training are taught to be vigilant and would always scrutinize an email’s content, the domain name linked within the email, etc.

Stopping scams like this isn’t about addressing each specific execution or tactic; the answer lies in elevating the user’s security awareness.

Don’t get hacked by social media phishing attacks!

Many of your users are active on Facebook, LinkedIn, and Twitter. Cybercriminals use these platforms to scrape profile information of your users and organization to create targeted spear phishing campaigns in an attempt to hijack accounts, damage your organization's reputation, or gain access to your network.

KnowBe4’s Social Media Phishing Test is a complimentary IT security tool that helps you identify which users in your organization are vulnerable to these types of phishing attacks that could put your users and organization at risk.

Here's how the Social Media Phishing Test works: