Security researchers have discovered a credential phishing campaign targeting customers at US cellular network Verizon.
According to cloud security platform Armorblox, the phishing email attempted to deceive people by masquerading as an important message sent by the support team at Verizon.
- The best antivirus software to keep you and your devices safe
- Best VPN: add an extra layer of security with a virtual private network
- Plus: This scary malware can cripple your PC — how to protect yourself
Urgent message
Armorblox claims in a blog post that the email asked customers of the carrier to read an urgent message by logging in to their online account.
It said the perpetrators attempted to further “the sense of fear” and underline “the paucity of time” by using “Your attention is urgently required” in the subject of the email.
In the email, the cyber crooks told victims to click a link that would take them to the Verizon website. However, using a "redirection" technique, they were sent to a spoofed Verizon website where they had to part with their email, Verizon account password, email account password, and phone number.
Bypassing email security
The researchers went on to explain that the phishing campaign was able to bypass email security mechanisms “because it didn’t follow the tenets of more traditional phishing attacks”.
Firstly, the crooks used an “unrelated parent domain” as part of the phishing campaign.
Armorblox explained: “By hosting phishing pages on unrelated parent domains after redirections, attackers are able to evade security controls based on URL/link protection and get past filters that block known bad domains.”
What also helped the crooks to evade detection was that they developed "a lookalike website with full phishing flow”. The researchers said the attackers wanted “people to fall prey to the superficial similarity of the phishing site to Verizon’s website”.
They explained: “Once targets fill in their login details (user ID and password), the phishing flow continues with another screen asking targets to enter their email address and email password.
“This way, attackers try to steal as much information as possible from targets who have bought into the faux legitimacy of the communication.”
Finally, the hackers opted for a socially engineered phishing campaign. The researchers said: “Unlike spray-and-pray email fraud attempts, this email was expressly created and sent to trigger the required response.
“The sender name was “Verizon Support” and the email was titled “Your attention is urgently required”, furthering the sense of fear and underlining the paucity of time at the targets’ disposal. The email language and topic was intended to induce urgency owing to its confidential nature (a secure message from Verizon). The call to action - LOGIN HERE - is simple and effective.”
Detecting the email
Armorblox said it detected the attack due to the "language, intent and tone of the email"; a "low communication history"; a "low domain frequency"; and a "suspicious phishing email".
The firm added: “Based on the insights above, along with many other detection signals, Armorblox flagged the email as a credential phishing threat. The email was automatically quarantined based on predetermined remediation actions for the credential phishing detection category."
Jake Moore, a security specialist at ESET, told Tom's Guide: "Phishing emails, whether they are traditional or bespoke, still contain a few telltale signs to look out for. The incoming address is one to investigate as a must but this can be duped or compromised with some clever tools.
"However, to mitigate compromise, it is vital that you verify the link in any communication before clicking on it which will inevitably take you to a well-crafted duplicate. It is easy to clone a website and make it look like what you would expect, however it is difficult to make the URL appear legitimate quickly so it is always worth those extra few checks before losing control of an account or personal data.”
- More: Stay anonymous without the spend with a cheap VPN
