Hybrid Cloud Strategies: The Next Legal Technology Trend?
The way legal firms use technology is changing fast. Many have already introduced public cloud tools to enhance everyday communication and...
1 min read
Heroic Technologies : Feb 7, 2022 1:15:00 PM
There is a new phishing campaign to keep a watchful eye on according to email security firm INKY. It’s a particularly fiendish one.
The attackers have designed an email template that does an admirable job of imitating the look and feel of emails sent from the US Department of Labor.
These are being sent out to recipients asking them to submit bids for an ongoing DOL project with the specifics of the project varying from one email to the next.
The emails are professionally and meticulously arranged. Thanks to some clever spoofing they appear to come from an actual Department of Labor server. Naturally they do not come from the DOL, and there are no ongoing projects that require the Department of Labor to blindly spam out emails seeking bids.
Nonetheless, an unwary recipient could easily be taken in by the scam and click the “Bid” button embedded in the email. That button is of course masking a malicious link which will take the email recipient to one of the phishing sites controlled by the scammers.
Like the emails themselves, these spoofed sites look completely legitimate. A comparison of the HTML and CSS on the scam sites with the actual Department of Labor reveals that they have identical code behind them which is clear evidence that the scammers scraped those sites and used the code to create their own copies.
What’s different is the fact that the scam site includes a pop-up message that is there seemingly to guide the email recipient through the bidding process. What it’s really doing is moving the potential victim closer to giving up his or her Office 365 credentials.
Of interest is that after a victim enters his/her credentials they’ll be prompted to enter them a second time. This is to minimize the risk of the scammers harvesting mis-typed credentials. They seem to have thought of everything!
There’s no good defense against this except for vigilance and mindfulness so please make sure your employees, friends, and neighbors are aware of the ongoing campaign.
The way legal firms use technology is changing fast. Many have already introduced public cloud tools to enhance everyday communication and...
When you think about compliance training, does your mind immediately picture massive corporations or those huge law firms with endless rows of desks?
Phishing, a deceptive practice aimed at stealing sensitive information from unsuspecting individuals, has emerged as one of the most prevalent and...
Scammers delight in impersonating government agencies and well-known brands to lure email recipients into giving up their personal information. That...
HTML attachments as an attack vector may seem a little old school. However, according to statistics compiled by Kaspersky Lab indicates that in 2022,...