Hackers are using a devilishly clever fake email attachment scam to break into people's accounts
Marco Di Lauro/Getty Images
A new email scam is circulating that aims to trick the user into giving up their email login details by sending over a (fake) link to a PDF to open.
And making it all the more plausible, the scam email is sent from compromised accounts and uses subject lines and file names that the target is likely to click on.
The phishing account was detailed in a recent blog post by WordFence, a WordPress security firm.
Here's how it works:
- The attacker, using a compromised email account, sends emails to that first victim's contacts.
- The email contains what appears to be a link to an attachment (often a PDF) hosted on Google Drive.
- This lowers the target's defences, because they can - in theory - view documents on Google Drive without having to download anything.
- If the would-be victim clicks the link, they'll be directed to a page masquerading as the Google login page.
- They enter their login details when prompted - and just like that, the hacker has access to their account!
- The attacker then starts the process all over again, targeting the most recent victim's contacts.
But here's the really clever bit - the email isn't just some generic template. It often actually borrows the subject line and (fake) file name from previous correspondence with the person being targeted, making it seem super plausible.
A commenter on news discussion site Hacker News wrote about his experience of the attack working at a school: "They went into one student's account, pulled an attachment with an athletic team practice schedule, generated the screenshot, and then paired that with a subject line that was tangentially related, and emailed it to the other members of the athletic team."
The school was "hit by this hard right before the holiday break," they wrote. "Three employees and a handful of students all got hit by the attack within a two hour period. It's the most sophisticated attack I've seen."
Here's how it looks:
WordFence wrote about the attack recently, but it has been going around for a while. A blog post on Gregmann.com in 2016 details how the author fell for it after he was emailed with a believable subject line by someone he had met a year prior.
Luckily, there's ways you can protect yourself against this. Security experts recommend you use a different, strong password for every account you have - meaning if your password on one site is compromised, all your other accounts aren't at risk as well. (There are password manager apps that you can use to store passwords if necessary.)
And you should enable two-factor authentication whenever possible, which means even if your password is compromised hackers can't get into to your account without access to your phone as well.
On a long enough timeline, everyone gets hacked. But if you're smart about it, you can limit the damage.
This is the closest I've ever come to falling for a Gmail phishing attack. If it hadn't been for my high-DPI screen making the image fuzzy… pic.twitter.com/MizEWYksBh- Tom Scott (@tomscott) December 23, 2016
- Gautam Adani, the man who may soon be Asia's richest person, is a college dropout who survived the 2008 Mumbai terrorist attacks and says he was once kidnapped for ransom
- EY is offering scholarships to Indian college students worth ₹1 lakh with two months’ internship opportunity
- A man had severe, day-long migraines for 12 years and nothing worked. His doctors say they vanished after they prescribed leafy greens and cutting out red meat.
- Centre raises Bengal labour budget for creation of 27 cr man-days
- Over a million Ethereum tokens have been burned since the big upgrade, but transaction costs are still a pain point for the network
- Loaded Lion NFT sells for $1 million — three days after launching at $200
- McDonalds India launches a contemporary rendition and continuation story of memorable campaign ‘Hum dono boyfriend-girlfriend hai kya’
- India to resume scheduled international flights from December 15, says Aviation Ministry