WyzGuys Tech Talk

And Sys Admin Appreciation Day!!

Phishing Email Alerts

Catch of the Day: IONOS Email Validation Phish

Chef’s Special:  HR and Security Phish Attacks

Examples of clever phish that made it past my spam filters and into my Inbox, or from clients, or reliable sources on the Internet.

I would be delighted to accept suspicious phishing examples from you.  Please forward your email to phish@wyzguys.com.

My intention is to provide a warning, examples of current phishing scams, related articles, and education about how these scams and exploits work, and how to detect them in your own inbox.  If the pictures are too small or extend off the page, double-clicking on them will open them up in a photo viewer app.

System Administrator Appreciation Day

July 30, 2021 – 22nd Annual

I am still accepting Arby’s Gift Cards or Bitcoin as a token of appreciation again this year.

IONOS Email Validation Phish

Summer vacation appears to be wrapping up for at least a few of the phishers.  I got this email today, with an HTML file attachment that creates a “web page” right on your own computer from the attachment.  Note the sender’s email address, and the misspelling in the subject line.

Moving to my Kali VM, I opened the file attachment, which was actually a ZIP archive.  The ZIP file contained the HTML landing page.

Here is the HTML page.  Note the URL in the web browser.  It shows that this page was spawned in my own computer.  No hijacked web server is required.  And this appears to be a credential stealing exploit, of course.

New Phishing Threat Infographic: Your Users Are Failing Security and HR-Related Attacks

KnowBe4’s latest quarterly report on top-clicked phishing email subjects is here. These are broken down into three different categories: social media related subjects, general subjects and ‘in the wild’ attacks.

HR Phishing Clicks are Spiking

There has been a significant rise in phishing email attacks related to HR topics, especially those regarding new policies that would affect all employees throughout many types of organizations. Real phishing emails that were reported to IT departments related to security-minded users about password checks continue to remain popular. Phishing email attacks leveraging COVID-19 were on every quarterly report in 2020, but those subjects have dropped dramatically in 2021. End users have become more savvy about scams related to that topic.

With more employees returning to the office, they are concerned about new policies that affect their everyday situations at work, which is why we are seeing a rise in these types of phishing attacks. These days, it is especially important for all end users to take a moment to double check a link or attachment and to question whether the email is expected or unexpected. Employees are truly an organization’s last line of defense.

LinkedIn Still Draws the Most Social Media Subject Clicks

LinkedIn phishing messages have dominated the social media category for the last three years. Users may perceive these emails as legitimate since LinkedIn is a professional network, which could pose significant problems because many LinkedIn users have their accounts tied to their corporate email addresses.

Top-clicked subjects in this category also include Facebook and Twitter notifications, message alerts and login alerts. See the full infographic with top messages in each category for last quarter.

Great to share with your users:
https://blog.knowbe4.com/infographic-q2-2021-users-falling-for-security-hr-phishing-attacks