1 min read

E-Mail From Department Of Labor Could Be Phishing Attack

There is a new phishing campaign to keep a watchful eye on according to email security firm INKY. It’s a particularly fiendish one.

The attackers have designed an email template that does an admirable job of imitating the look and feel of emails sent from the US Department of Labor.

These are being sent out to recipients asking them to submit bids for an ongoing DOL project with the specifics of the project varying from one email to the next.

The emails are professionally and meticulously arranged. Thanks to some clever spoofing they appear to come from an actual Department of Labor server. Naturally they do not come from the DOL, and there are no ongoing projects that require the Department of Labor to blindly spam out emails seeking bids.

Nonetheless, an unwary recipient could easily be taken in by the scam and click the “Bid” button embedded in the email.  That button is of course masking a malicious link which will take the email recipient to one of the phishing sites controlled by the scammers.

Like the emails themselves, these spoofed sites look completely legitimate. A comparison of the HTML and CSS on the scam sites with the actual Department of Labor reveals that they have identical code behind them which is clear evidence that the scammers scraped those sites and used the code to create their own copies.

What’s different is the fact that the scam site includes a pop-up message that is there seemingly to guide the email recipient through the bidding process.  What it’s really doing is moving the potential victim closer to giving up his or her Office 365 credentials.

Of interest is that after a victim enters his/her credentials they’ll be prompted to enter them a second time.  This is to minimize the risk of the scammers harvesting mis-typed credentials.  They seem to have thought of everything!

Vigilance & Mindfulness Are the Best Defence

There’s no good defense against this except for vigilance and mindfulness so please make sure your employees, friends, and neighbors are aware of the ongoing campaign.

Used with permission from Article Aggregator

Why Your Business Should Use a Password Manager

To the average person, it’s too easy to forget a password and leave themselves vulnerable to account lockout, which can end up being a real hassle....

Read More

AirPods Pro Repair Program Extended For Static Sound Problems

Are you an AirPods Pro owner? Do yours crackle and hiss? If you answered yes to both of those questions be aware that Apple has recently extended the...

Read More
Why Legal Practices Need San Jose IT Support & Managed Services

Why Legal Practices Need San Jose IT Support & Managed Services

Managed IT is crucial for law firms trying to deal with the complexities of managing technology. These services include a variety of solutions aimed...

Read More

Recognizing and Avoiding Email Scams 

Phishing, a deceptive practice aimed at stealing sensitive information from unsuspecting individuals, has emerged as one of the most prevalent and...

Read More

Top 10 Brands That Phishing Attackers Use to Scam Users

Scammers delight in impersonating government agencies and well-known brands to lure email recipients into giving up their personal information. That...

Read More

New Phishing Attacks Use HTML Email Attachments

HTML attachments as an attack vector may seem a little old school. However, according to statistics compiled by Kaspersky Lab indicates that in 2022,...

Read More