Phishing Attack Targets Humanitarian Organizations

Unicef_LogoResearchers at Lookout have discovered an ongoing phishing campaign targeting humanitarian non-governmental organizations (NGOs), including UNICEF and the Red Cross. The infrastructure used in the attack went live in March 2019, and is hosting phishing pages on two domains. The phishing pages can adapt to mobile devices and can record keystrokes as they are entered into the password field. This allows the attackers to receive anything the user types, even if they don’t hit enter.

The sites imitate OneDrive login portals and are tailored to each targeted organization. Six of the sites still have valid SSL certificates, and Lookout believes these sites are still being used by the attackers. The six organizations being targeted by these sites are the UN World Food Programme, the United Nations Development Programme, the United Nations, UNICEF, the International Federation of the Red Cross and Red Crescent Societies, and the Heritage Foundation think tank.

Lookout warns that the mobile-focused aspect of this campaign is a sign that attackers are increasingly putting in the effort to target mobile devices. The researchers note that mobile web browsers make it harder to spot phishing attacks, since they truncate URLs and show less details than a desktop browser. The risk of these attacks is also growing, due to the increased overlap of mobile devices between personal and corporate use. New-school security awareness training can help your employees keep up with these evolving attacks.

Lookout has the story:

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews