Surety IT provides a monthly security alert of the scams impacting Australian businesses including phishing scams, malware attacks and security breaches/bugs.
You need to be particularly aware of:
Westpac Phishing Email
- This latest phishing email is titled ‘Online activity on-hold !’, uses a display name of ‘Westpac’ and uses a domain not belonging to Westpac.
- Including Westpac branding, it advises recipients that ‘Your online purchases have been stopped’ and that payment details could not be verified.
- Recipients are directed to resolve this problem and to ‘avoid suspension of your online activity’ by updating account details via a link.
- Those who click the link are directed to a fake Westpac branded login page which requests the customer ID and password, this website is also not hosted on a domain belonging to Westpac.
- Once ‘signed in’, users are led to another page which requests further personal information such as credit card details, email address & password which unlocks the account if the information is provided.
- The purpose of this phishing scam is to obtain login credentials so cyber criminals can break into bank accounts.
- Red flags in this email scam include spelling errors, and non Westpac owned domains.
Office 365 Phishing Email
- Using a display name of ‘Mail Delivery System’, forges recipient’s address as the envelope address and is titled “You have 8 pending emails for…”
- Included in the body of the email is a button for users to “review messages to release or block them”
- Those who clink on the link are led to a domain not belonging to Office 365 which requests recipients to log in using their Outlook credentials.
- Red flags in this phishing scam include; a link to a suspicious page, and the phishing web page not looking like an official Microsoft sign-in page.
Adobe Creative Cloud Service Phishing Email
- Masqueraded as a new document sharing notification, this email scam is designed to harvest confidential information.
- Titled “SD-0035890” and sent from a compromised email address.
- Informs recipients that a “secured document” has been shared using “Adobe Creative Cloud Service”.
- The link provided directs users to a page containing the GetAccept logo and a blurred preview of the supposed file is included along with download or view file links.
- Should users click on the file, they are directed to another page which requests an email account to be selected and then to a login page.
- After entering login details, users are redirected to the Google homepage.
- Red flags in this email scam include; the email doesn’t address the recipient directly, and Adobe’s branding and logos aren’t included.
Dropbox Phishing Campaign
- Several variants of scams purporting to be from Dropbox are hitting inboxes.
- One includes a PDF which is a ‘project proposal’, another invites recipients to ‘view’ the PDF file.
- Aim of these emails scams is to harvest user credentials.
Covid-19 Scams
Scammers continue to use the spread of COVID-19 (coronavirus) to take advantage of people across Australia, with a wide range of scams including phishing scams, superannuation scams, online shopping scams, and scams specifically targeting businesses.
Business Scam example
Scammers are using COVID-19 in business email compromise scams by pretending to be a supplier or business you usually deal with. Scammers are using COVID-19 as an excuse to divert your usual account payments to a different bank account. Your payment goes to the scammer instead of the real business.
If you’d like any further information, assistance with your cyber security or you don’t know where to start, please call us on 1300 478 738 or Email us.
