Hackers are phishing telecom workers and “authorized retailers” to steal credentials and gain access to internal company tools. The end game is to modify SIM settings to help with a separate identity theft scam.
Attackers intent on installing malware that provides access to a victim’s network via phishing are looking for something within that network – it could be valuable data that can be sold on the dark web (such as the credit card data in the recent Wawa breach), or in the case of cellular companies, the goal is to access the internal application responsible for performing SIM swaps.
Attackers that want to commit identity theft online usually need to have a second factor of authentication – a mobile phone in most cases. So, how better to get control of that phone than to make the victim’s phone become attacker’s phone? And what easier way to do that than to simply phish the mobile telecom company, gain access to the responsible application, and just make the change?
This is the attack plan currently being seen by users at mobile companies such as T-Mobile, AT&T, Verizon, and Sprint.
The bad news here is that this kind of attack can have ramifications that impact millions of people. The good news is that phishing is an attack vector that is easily stopped. By using a combination of layered endpoint protection solutions and Security Awareness Training, both the employee’s device and the employee are acting as part of the organization’s security stance.
Here's how it works:
