phishing Password reset notification scam Anti-phishing lessons: what company employees should know about fake notifications about account security. Roman Dedenok February 22, 2022 Most online services have a built-in security system that alerts you when it detects “unusual” activity on your account. For example, services send notifications about attempts to reset the phone number and e-mail address linked to the account, or the password. Of course, as soon as such messages became commonplace, enterprising cybercriminals tried to imitate this mechanism to attack corporate users. Example of a fake notification If it’s a public online service attackers will usually make every effort to create exact copies of a real message. However, if attackers are hunting for access to an internal system, they often have to use their imagination as they might not know how the email should appear. Real example of a fake notification about a change of phone number. Everything about this message looks ridiculous, from the incorrect language to the rather dubious logic — it seems to be at once about linking a new phone number and about sending a password reset code. Nor does the “support” e-mail address lend credibility to the message: there is no plausible reason why a support mailbox should be located on a foreign domain (let alone a Chinese one). The attackers are hoping that their victim, fearing for the security of their account, will click the red DON’T SEND CODE button. Once done, they’re redirected to a website mimicking the account login page, which, as you’d imagine, just steals their password. The hijacked mail account can then be used for BEC-type attacks or as a source of information for further attacks using social engineering. What to explain to company employees To minimize the chances of cybercriminals getting their hands on employees’ credentials, communicate the following to them: Never click on links in automatic security notifications, whether real looking or not. On receiving a notification, check the security settings and linked details, do so by opening the website in the browser manually. A clumsily worded notification (as in the example) is best ignored and deleted. If the notification looks real, notify the IS service or security officer; it may be a sign of a targeted attack. How to protect company employees from phishing In general, it’s best to keep phishing e-mails out of employee inboxes altogether. Ideally, they (plus all other unwanted correspondence, including spam, messages with malicious attachments and BEC-related e-mails) should be intercepted at the mail gateway level. To combat these very threats, we have recently updated our e-mail protection solution for gateways. Learn more on the Kaspersky Secure Mail Gateway page.
Read next Attack on a bank in Latin America How threat intelligence helps prevent cyberattacks on enterprises.
Tips How to improve your resume with AI without exposing your data Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.
Tips How can students overcome the fear of unfulfilled potential, and where does cybersecurity come into it? University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.
Tips Nine reasons to set up a VPN on your router Get the most speed, reliability, and convenience out of your VPN by putting it on your router. Here’s a look at the real benefits of specific VPN setup scenarios for your whole home network.
Tips Fact and fiction about hidden Wi-Fi network names Hiding your Wi-Fi network name might seem like a smart security move, but in practice it does more harm than good. Let’s take a look at how it works, what side effects it can have, and how to properly secure your home Wi-Fi.