One Letter Away: Impersonation, Bitcoin, and Phishing Expeditions

impersonation bitcoin phishingKrebsOnSecurity reports that a phishing website has been impersonating the private messaging service in order to steal Bitcoin. The real Privnote is a free site that allows users to send encrypted messages that are automatically erased after being read. The owner of Privnote contacted Krebs in February telling him that someone had created a copy of their site at the domain “privnotes[.]com.” The spoofed site contained a messaging service, but the messages were sent in plain text and could be read or modified by the site’s operators. And the bogus domain name was just one character off.

It wasn’t clear what the spoofed site’s intent was until Krebs found that it contained a script that would automatically replace Bitcoin addresses in messages composed by users with an address presumably controlled by the site’s owner. Allison Nixon, chief research officer at Unit 221B, told Krebs that the nature of the site made it easier for this scam to remain undetected for months.

“Because of the design of the site, the sender won’t be able to view the message because it self destructs after one open, and the type of people using privnote aren’t the type of people who are going to send that bitcoin wallet any other way for verification purposes,” Nixon said. “It’s a pretty smart scam.”

Krebs notes that Privnotes[.]com appeared as the second Google result for “privnote,” and the scammers even paid for deceptive Google ads so that their site would show up at the top of the search results with the title “Privnote.”

“Even if you never use or plan to use the legitimate encrypted message service, this scam is a great reminder why it pays to be extra careful about using search engines to find sites that you plan to entrust with sensitive data,” Krebs writes. “A far better approach is to bookmark such sites, and rely exclusively on those instead.”

New-school security awareness training can teach your employees to pay close attention to URLs and other indicators of legitimacy, especially when they’re entering sensitive information.

KrebsOnSecurity has the story:

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews