Phishing campaigns are constantly evolving and increasing in sophistication. Two notable campaigns have recently targeted our community; one involved a sextortion threat, and the other involved a bogus “job offer.” These types of scams aren’t new, but they do reflect an emerging trend of profiling their targets. Rather than using a simple list of email addresses, threat actors now commonly collect contact information, physical addresses, social media accounts, and even employment history, including supervisor and subordinate relationships, to craft more compelling attacks.
In the sextortion campaign, perpetrators claimed to have control over victims’ devices and threatened to release sensitive information unless a ransom is paid. To add a layer of credibility to the scam, the messages were personalized, including a home address and an image of the residence. This is designed to suggest the attacker has some personal access to the target. However, this information is easily obtained on the Internet. The image can be found on Google Maps Street View. The attacker used a unique sender email address, a unique subject line, and a unique name for the attachment for each target. This makes programmatic methods of detecting and blocking these messages extremely challenging.
In the other campaign, the fraudster posed as a prominent professor, inviting individuals to participate in a non-existent research study. They used a Gmail address designed to appear as their personal email address. They requested personal contact information, such as cell phone numbers or email addresses. They aim to circumvent our cybersecurity controls and establish direct communication with their targets so that ITS cannot interfere with their scheme.
Since technical controls are largely ineffective in mitigating these specific threats, everyone must be equipped to spot these and other common phishing scams. It is important to:
- Scrutinize email messages, particularly from outside senders. Pay attention to the sender’s address, grammar, formatting, and content.
- If something seems too good to be true, it probably is. Scammers don’t always offer outrageous sums of money as a prize, unclaimed inheritance, or payment to help transfer money out of the country. Some offer jobs with slightly higher-than-expected compensation so as not to invoke too much suspicion.
- Beware of messages that try to elicit fear or urgency. Phishing attacks often do this to pressure victims into making hasty and unwise decisions.
- Talk with others about anything that doesn’t seem right. If you’re unsure about a message, discuss it with a colleague, friend, or family member.
- Confirm the authenticity of a message using a known-good method. Contact the sender using a known-good phone number or email address to confirm a suspect message’s legitimacy.
- Report phishing. In Gmail, you can report a message as phishing in the browser client. This is distinct from reporting a message as spam. You can find the “Report phishing” feature in the menu in the top right corner of the Gmail message window.
- Contact the ITS Helpdesk if you need help. If you are unsure if you have been the target of a phishing attack, contact the Helpdesk. They are there to help.
By staying informed about emerging threats and adopting these good practices, individuals can better protect themselves from the evolving danger of phishing attacks. For more security tips, check out this article.