Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label SMS Phishing. Show all posts
USA
Cyber Attacks FBI phishing Road Toll SMS Phishing USA

Nationwide Scam Targets Road Toll Users via SMS Phishing Scheme

 



The Federal Bureau of Investigation (FBI) has alerted the public to a widespread SMS phishing scam sweeping across the United States. The scam, which began in early March 2024, specifically targets individuals with fraudulent messages regarding unpaid road toll fees.

What Does The Scam Entails?

Thousands of Americans have already fallen victim to this harrowing scam, with over 2,000 complaints flooding the FBI's Internet Crime Complaint Center (IC3) from at least three states. The deceptive messages typically claim that the recipient owes money for outstanding tolls, urging them to click on embedded hyperlinks.

The perpetrators behind these attacks employ sophisticated tactics to deceive their targets. By impersonating legitimate toll services and altering phone numbers to match those of the respective states, they create a false sense of authenticity. However, the links provided within the messages lead to fake websites designed to extract personal and financial information from unsuspecting victims.

Cautionary Advice

Authorities are urging individuals who receive such messages to exercise caution and take immediate action. The Pennsylvania Turnpike, one of the affected toll services, has advised recipients not to click on any suspicious links and to promptly delete the messages. Similarly, the Pennsylvania State Police have issued warnings about the scam, emphasising the dangers of providing personal information to fraudulent sources.

To safeguard against falling prey to this scam, the FBI recommends several preventive measures. Victims are encouraged to file complaints with the IC3, providing details such as the scammer's phone number and the fraudulent website. Additionally, individuals should verify their toll accounts using the legitimate websites of the respective toll services and contact customer service for further assistance. Any suspicious messages should be promptly deleted, and if personal information has been compromised, immediate steps should be taken to secure financial accounts and dispute any unauthorised charges.

What Is Smishing?

Smishing, a blend of "SMS" and "phishing," is a form of social engineering attack wherein fraudulent text messages are used to deceive individuals into divulging sensitive information or downloading malware. In this instance, the scam preys on individuals' concerns regarding unpaid toll fees, exploiting their trust in official communication channels.

As the SMS phishing scam continues to proliferate, it is imperative for individuals to remain vigilant and sceptical of unsolicited messages. By staying informed and taking proactive measures to protect personal information, users can mitigate the risks posed by such malicious activities. Authorities are actively investigating these incidents, but it is crucial for the public to be proactive in safeguarding their financial and personal information from exploitation.


Read more »
User Privacy
Cyber Fraud Data Safety Email scam Smishing Campaign SMS Phishing User Privacy

Smishing: SMS Phishing Attacks And How to Thwart Them

 

Smishing is a fast growing version of one of the most established and lucrative scams on the internet. Smishing, like other forms of phishing, aims to trick you into revealing sensitive data and information; however, instead of email, cybercriminals use text messaging or short message services (SMS) to interact with you. Smish attempts are frequently delivered as regular SMS to mobile phone subscribers, but they can also be sent via popular messaging apps. 

Smishing is a type of social engineering in which fraudsters exploit emotions such as fear, sympathy, curiosity, or greed to induce others to reveal personal or business information. They manage this by sending fake messages to your phone or other mobile device that appear to be from a trustworthy source, such as a delivery service, utility supplier, bank, or government agency.

The information they seek could include usernames, passwords, bank account numbers, credit card numbers, vendor names, and other confidential data. The data is subsequently sold on the dark web by cybercriminals, who can also employ it to steal identities, empty bank accounts, or reroute funds to themselves.

Smishing is more tempting to cybercriminals since users are more likely to trust texts over other kinds of communication. In fact, people respond to 45 percent of their texts, but only 6 percent of their emails receive a response. This is most likely due to years of email oversaturation; inboxes bombarded with promotional offers and spam have been trained users to be wary. 

Prevention tips

Here are five ways to prevent scammers from stealing private data: 

  • Never click on hyperlinks in texts from suspicious or unknown numbers. If the link is a brief, shortened URL, this is twice as true. Shorter URLs are frequently cited as a telltale sign that fraudsters are attempting to conceal obviously fake URLs in SMS messages. 
  • Be cautious; if you are persuaded to pay or disclose personal information, take a moment to confirm that the source is authentic and trustworthy. 
  • Never respond to texts from unknown or suspect numbers, especially if they ask you to do so. This notifies scammers that your phone number is active, and you may be added to spam lists and harassed further. 
  • To protect against malware concealed in smishing URLs, keep your phone's operating system up to date at all times.
  • Pay attention to telltale signs of social engineering, such as urgent messages or get-rich-quick schemes. If something appears to be too good to be true, it most likely is.
Read more »
Software
Cyber Security Financial Loss Hackers Identity Theft Passwords Smishing Scam SMS Phishing Software

Beware: Government's Alert on Smishing Scam Threat

The Indian government has now urgently warned its citizens about the threat posed by smishing scams. Smishing, a combination of the words 'SMS' and 'phishing,' is the practice of hackers sending false text messages to people in an effort to get their sensitive personal information. This official warning serves as a reminder that residents need to be more vigilant and knowledgeable.

The warning highlights that cybercriminals are exploiting SMS communication to carry out their malicious intentions. These messages often impersonate legitimate entities, such as banks, government agencies, or popular online services, luring recipients into clicking on malicious links or sharing confidential information. The consequences of falling victim to smishing can be dire, ranging from financial loss to identity theft.

To shield themselves against this growing menace, citizens are urged to follow certain precautions:

1. Verify the Source: Always double-check the sender's details and the message's authenticity. Contact the organization directly using official contact information to confirm the legitimacy of the message.

2. Don't Click Hastily: Refrain from clicking on links embedded in SMS messages, especially if they ask for personal information or prompt immediate action. These links often lead to fraudulent websites designed to steal data.

3. Guard Personal Information: Never share sensitive information like passwords, PINs, Aadhar numbers, or banking details via SMS, especially in response to unsolicited messages.

4. Implement Security Measures: Install reliable security software on your mobile devices that can detect and block malicious texts. Regularly update the software for enhanced protection.

5. Educate Yourself: Stay informed about the latest smishing techniques and scams. Awareness is a strong defense against falling victim to such tricks.

6. Report Suspicious Activity: If you receive a suspicious SMS, report it to your mobile service provider and the local authorities. Reporting aids in tracking and preventing such scams.

The government's warning serves as a reminder that while technology enriches our lives, it's vital to remain cautious. Cybercriminals are continuously devising new ways to exploit unsuspecting individuals, making it imperative for everyone to stay well-informed and adopt preventive measures.

Read more »
SMS Phishing
Android Android Users Cyber Fraud Data-Stealing Iran Mallicious Apps phishing Scam SMS Phishing

Researchers: Iranian Users Beware of Widespread SMS Phishing Campaigns

 

Socially engineered SMS texts are being utilized to install malware on Android smartphones, as part of a large phishing operation that impersonates the Iranian government and social security authorities in order to steal credit card information and funds from victims' bank accounts, 

Unlike other types of banking malware that use overlay attacks to steal sensitive data without the victim's knowledge, the financially motivated operation discovered by Check Point Research is developed to trick victims into handing over their credit card information by sending them a legitimate-looking SMS message with a link that, when clicked, downloads a malware-laced app onto their devices. 

Check Point researcher Shmuel Cohen stated in a new report published Wednesday, "The malicious application not only collects the victim's credit card numbers, but also gains access to their 2FA authentication SMS, and turn[s] the victim's device into a bot capable of spreading similar phishing SMS to other potential victims." 

As per the cybersecurity firm, it discovered hundreds of distinct phishing Android apps masquerading as device tracking apps, Iranian banks, dating and shopping sites, cryptocurrency exchanges, and government-related services, with these botnets sold as a "ready-to-use mobile campaign kit" on Telegram channels for somewhere between $50 and $150. 

The infection chain of the smishing botnet begins with a bogus notification from the Iranian judiciary requesting users to evaluate a fictitious complaint made against the message's receivers. The complaint link takes victims to what appears to be a government website, where they are requested to provide personal information (e.g., name, phone number, etc.) and download an Android APK file. 

Once downloaded, the rogue app not only demands invasive rights to execute operations typically not associated with such government applications, but it also displays a false login page that resembles Sana, the country's electronic judicial notice system, and prompts the victim to pay a $1 payment to proceed. Users who choose to do so are then sent to a bogus payment page that captures the credit card information submitted, while the installed software acts as a covert backdoor to harvest one-time passcodes given by the credit card provider and assist more fraud. 

Furthermore, the malware has a plethora of functionality, including the ability to exfiltrate all SMS messages received by a device to an attacker-controlled server, conceal its icon from the home screen to circumvent attempts to remove the app, deploy extra payloads, and obtain worm-like powers to broaden its attack surface. 

Prevent data breaches 

Cohen explained, "This allows the actors to distribute phishing messages from the phone numbers of typical users instead of from a centralized place and not be limited to a small set of phone numbers that could be easily blocked. This means that technically, there are no 'malicious' numbers that can be blocked by the telecommunication companies or traced back to the attacker." 

To make matters worse, the attackers behind the operation were discovered to have inadequate operational security (OPSEC), enabling any third party to openly access the phone numbers, contacts, SMS messages, and list of any online bots stored on their servers. 

"Stealing 2FA dynamic codes allows the actors to slowly but steadily withdraw significant amounts of money from the victims' accounts, even in cases when due to the bank limitations each distinct operation might garner only tens of dollars." 

"Together with the easy adoption of the 'botnet as a service' business model, it should come as no surprise that the number of such applications for Android and the number of people selling them is growing," he added.
Read more »
Subscribe to: Posts (Atom)