As part of a massive ongoing phishing campaign, the same group of attackers leverage hundreds of lookalike phishing websites to steal from unsuspecting banking customers. Security researchers at CheckPoint have uncovered a two-year phishing campaign targeting customers of Canadian banks. Emails sent under the guise that banking users need to activate a digital certificate as part of their “online enrollment” appear to be enough of a ruse to cause their victims to click on the bogus PDF attachments.
Users are taken to look-alike logon pages, are prompted to provide their ID and password, and then are asked to provide the two-factor authentication sent to their mobile.
The scam here is that while the user is waiting for the supposed text to come in, the bad guys are logging into the victims accounts and transferring money.
While this attack focuses on consumers, the methods used can easily be leveraged to steal credentials for business-related websites. The use of actual two-factor authentication can minimize the chances of a successful attack, although there have been instances where two-factor authentication logon requests have been successfully bypassed.
So, it’s important to also arm your users with Security Awareness Training so they understand the methods used to attempt to trick them into providing credentials and, potentially, putting your organization at risk.
Here's how MASA works:
