A phishing campaign is targeting college students with phony part-time job opportunities, according to Jeremy Fuchs at Avanan. The emails purport to come from the colleges’ job placement department, stating, “Paying for college isn’t easy; your financial aid only covers some of the costs. Whether you want to cover more tuition, or you’d like to have some pocket-money for each week, a job will afford you that financial leeway. There is a remote job opportunity in accordance with the work and study regulations of the Institution.”
Fuchs notes that the emails are sent from a legitimate, compromised account, so they’re more likely to bypass security filters.
“This email offers a remote, part-time, $450 job opportunity,” Fuchs writes. “The email comes from a legitimate email; however, the link is malicious, which means that this chain started as an account takeover. (The job offer also has nothing to do with the company that sent it out.) When a student clicks on the link, they are redirected to a page that instead steals their credentials. No job here. This is a good example of social engineering–the hackers are dangling a lure for the end-user to pick up on. It may not work in every scenario, but all it takes is one click to be successful.”
Fuchs concludes that at least some students will fall for these convincing phishing emails.
“Hackers are really good at targeting people at vulnerable moments,” Fuchs says. “Here, they are targeting students who are in need of a job and cash. Sending these students an offer of a good-paying, fairly low-time commitment job could seem too good to be true. But for a student hungry for cash, the too-good-to-be-true nature might not matter. They see a job offer and will want to click on the link. Clicking on the link, however, will not provide the job they think. It will just steal their credentials.”
New-school security awareness training can give your employees a healthy sense of suspicion so they can avoid falling for social engineering attacks.
Avanan has the story.
