So here’s a new one: a spoofed Amazon email claiming that Amazon has detected an unauthorized attempt to reset the password on the recipient’s account. A six digit code is provided along with instructions to call a phone number to “verify your identity.” A copy of this phish is above.
A number of users online have reported receiving this phish over the past month. Some have even called the provided phone number. They report their calls being answered by individuals speaking with a thick Indian accent who then attempt to direct them to a web site in order to input more information. Here are two scam alert sites with people filing reports:
We have yet to find a user providing a detailed account of just where the scam web site is that people get redirected to, or what information is requested. Our guess at this point is that it’s either an elaborate credentials phish or the set up for a techsupport scam where the bad guys inform users that they must download a RAT (remote access trojan) to allow their personnel to “clean” users' PCs of malware.
Warn your users to not fall for this new phishing scam that uses social engineering to manipulate them into allowing the bad guys into their workstation.
How weak are your user's passwords?
Are your user’s passwords…P@ssw0rd? Bad guys are constantly coming out with new ways to hack your network while evading detection.
Employees are the weakest link in network security, using weak passwords and falling for phishing and social engineering attacks.
Verizon's recent Data Breach Report showed that 81% of hacking-related breaches used either stolen and/or weak passwords.
KnowBe4’s complimentary Weak Password Test (WPT) checks your Active Directory for several different types of weak password related threats.
WPT gives you a quick look at the effectiveness of your password policies and any fails so that you can take action. This tests against 10 types of weak password related threats for example; Weak, Duplicate, Empty, Never Expires, plus 6 more.
Here's how the Weak Password Test works:
Reports on the accounts that are affected
Tests against 10 types of weak password related threats
Does not show/report on the actual passwords of accounts
Just download the install and run it
Results in a few minutes!
This will take you 5 minutes and may give you some insights you never expected!
Requirements: Active Directory, Windows 7 or higher (32 or 64bit)
Don't like to click on redirected button? Cut&Paste this link in your browser:
Related Pages: Security Awareness Training