Hackers are using a devilishly clever fake email attachment scam to break into people's accounts
Marco Di Lauro/Getty Images
A new email scam is circulating that aims to trick the user into giving up their email login details by sending over a (fake) link to a PDF to open.
And making it all the more plausible, the scam email is sent from compromised accounts and uses subject lines and file names that the target is likely to click on.
The phishing account was detailed in a recent blog post by WordFence, a WordPress security firm.
Here's how it works:
- The attacker, using a compromised email account, sends emails to that first victim's contacts.
- The email contains what appears to be a link to an attachment (often a PDF) hosted on Google Drive.
- This lowers the target's defences, because they can - in theory - view documents on Google Drive without having to download anything.
- If the would-be victim clicks the link, they'll be directed to a page masquerading as the Google login page.
- They enter their login details when prompted - and just like that, the hacker has access to their account!
- The attacker then starts the process all over again, targeting the most recent victim's contacts.
But here's the really clever bit - the email isn't just some generic template. It often actually borrows the subject line and (fake) file name from previous correspondence with the person being targeted, making it seem super plausible.
A commenter on news discussion site Hacker News wrote about his experience of the attack working at a school: "They went into one student's account, pulled an attachment with an athletic team practice schedule, generated the screenshot, and then paired that with a subject line that was tangentially related, and emailed it to the other members of the athletic team."
The school was "hit by this hard right before the holiday break," they wrote. "Three employees and a handful of students all got hit by the attack within a two hour period. It's the most sophisticated attack I've seen."
Here's how it looks:
WordFence wrote about the attack recently, but it has been going around for a while. A blog post on Gregmann.com in 2016 details how the author fell for it after he was emailed with a believable subject line by someone he had met a year prior.
REUTERS/Pawel Kopczynski
Luckily, there's ways you can protect yourself against this. Security experts recommend you use a different, strong password for every account you have - meaning if your password on one site is compromised, all your other accounts aren't at risk as well. (There are password manager apps that you can use to store passwords if necessary.)
And you should enable two-factor authentication whenever possible, which means even if your password is compromised hackers can't get into to your account without access to your phone as well.
On a long enough timeline, everyone gets hacked. But if you're smart about it, you can limit the damage.
This is the closest I've ever come to falling for a Gmail phishing attack. If it hadn't been for my high-DPI screen making the image fuzzy… pic.twitter.com/MizEWYksBh
- Tom Scott (@tomscott) December 23, 2016
- I spent $2,000 for 7 nights in a 179-square-foot room on one of the world's largest cruise ships. Take a look inside my cabin.
- Colon cancer rates are rising in young people. If you have two symptoms you should get a colonoscopy, a GI oncologist says.
- Saudi Arabia wants China to help fund its struggling $500 billion Neom megaproject. Investors may not be too excited.
- Catan adds climate change to the latest edition of the world-famous board game
- Tired of blatant misinformation in the media? This video game can help you and your family fight fake news!
- Tired of blatant misinformation in the media? This video game can help you and your family fight fake news!
- JNK India IPO allotment – How to check allotment, GMP, listing date and more
- Indian Army unveils selfie point at Hombotingla Pass ahead of 25th anniversary of Kargil Vijay Diwas