Researchers at Lookout have discovered an ongoing phishing campaign targeting humanitarian non-governmental organizations (NGOs), including UNICEF and the Red Cross. The infrastructure used in the attack went live in March 2019, and is hosting phishing pages on two domains. The phishing pages can adapt to mobile devices and can record keystrokes as they are entered into the password field. This allows the attackers to receive anything the user types, even if they don’t hit enter.
The sites imitate OneDrive login portals and are tailored to each targeted organization. Six of the sites still have valid SSL certificates, and Lookout believes these sites are still being used by the attackers. The six organizations being targeted by these sites are the UN World Food Programme, the United Nations Development Programme, the United Nations, UNICEF, the International Federation of the Red Cross and Red Crescent Societies, and the Heritage Foundation think tank.
Lookout warns that the mobile-focused aspect of this campaign is a sign that attackers are increasingly putting in the effort to target mobile devices. The researchers note that mobile web browsers make it harder to spot phishing attacks, since they truncate URLs and show less details than a desktop browser. The risk of these attacks is also growing, due to the increased overlap of mobile devices between personal and corporate use. New-school security awareness training can help your employees keep up with these evolving attacks.
Lookout has the story: https://blog.lookout.com/lookout-phishing-ai-discovers-phishing-attack-targeting-humanitarian-organizations
Here's how it works:
