Hackers are using a devilishly clever fake email attachment scam to break into people's accounts
Marco Di Lauro/Getty Images
A new email scam is circulating that aims to trick the user into giving up their email login details by sending over a (fake) link to a PDF to open.And making it all the more plausible, the scam email is sent from compromised accounts and uses subject lines and file names that the target is likely to click on.Advertisement
The phishing account was detailed in a recent blog post by WordFence, a WordPress security firm.
Here's how it works:
- The attacker, using a compromised email account, sends emails to that first victim's contacts.
- The email contains what appears to be a link to an attachment (often a PDF) hosted on Google Drive.
- This lowers the target's defences, because they can - in theory - view documents on Google Drive without having to download anything.
- If the would-be victim clicks the link, they'll be directed to a page masquerading as the Google login page.
- They enter their login details when prompted - and just like that, the hacker has access to their account!
- The attacker then starts the process all over again, targeting the most recent victim's contacts.
A commenter on news discussion site Hacker News wrote about his experience of the attack working at a school: "They went into one student's account, pulled an attachment with an athletic team practice schedule, generated the screenshot, and then paired that with a subject line that was tangentially related, and emailed it to the other members of the athletic team."The school was "hit by this hard right before the holiday break," they wrote. "Three employees and a handful of students all got hit by the attack within a two hour period. It's the most sophisticated attack I've seen."Here's how it looks:Advertisement
WordFence wrote about the attack recently, but it has been going around for a while. A blog post on Gregmann.com in 2016 details how the author fell for it after he was emailed with a believable subject line by someone he had met a year prior.
And you should enable two-factor authentication whenever possible, which means even if your password is compromised hackers can't get into to your account without access to your phone as well.
On a long enough timeline, everyone gets hacked. But if you're smart about it, you can limit the damage.
This is the closest I've ever come to falling for a Gmail phishing attack. If it hadn't been for my high-DPI screen making the image fuzzy… pic.twitter.com/MizEWYksBh- Tom Scott (@tomscott) December 23, 2016
- Microsoft cuts editorial staff, to replace them with AI: Report
- Google responds to European Commission's call for responsible AI
- India records highest single-day spike of 265 deaths, 7,964 cases on May 30
- May monthly auto sales data is unlikely to fire up the spirits
- Instagram to show ads on IGTV, experts tell us what it could mean for influencers