WyzGuys Tech Talk

Phishing Email Alerts

Catch of the Day:  Paralegal Phish

Chef’s Special:  

Examples of clever phish that made it past my spam filters and into my Inbox, or from clients, or reliable sources on the Internet.

I would be delighted to accept suspicious phishing examples from you.  Please forward your email to phish@wyzguys.com.

My intention is to provide a warning, examples of current phishing scams, related articles, and education about how these scams and exploits work, and how to detect them in your own inbox.  If the pictures are too small or extend off the page, double-clicking on them will open them up in a photo viewer app.

Paralegal Phish

Here’s an example of the “Consent Phishing” exploit that Microsoft warded about last week.  Here’s the email.  Looks like some forms from a law office.

Review Document link resolves to https://sites.google.com/view/progr0ups/ which took me to the first landing page.

Clicking on the Review button resolved to https://shadow-shore-steed.glitch.me/descrop.html.  We saw a glitch.me URL in a similar scam last week.

This landing page looks similar to the type of scam that was discussed last week the the post  Microsoft Warns of Latest “Consent Phishing” Attack Intent on Reading Your Email. Do not fall for this exploit, it is another way to separate you from your login credentials.

 Beware of New QuickBooks Payment Scams

Many small and mid-sized companies use Intuit’s popular QuickBooks program. They usually start out using its easy-to-use base accounting program and then the QuickBooks program aggressively pushes other complimentary features. One of those add-on features is the ability to send customers’ invoices via email.

The payee can click on a “Review and pay” button in the email to pay the invoice. It used to be a free, but less mature, feature years ago, but these days, it costs extra. Still, if you are using QuickBooks for your accounting, the ability to generate, send, receive and electronically track invoices all in one place is a pretty easy sell.

Unfortunately, phishing criminals are using QuickBooks’ popularity to send business email compromise (BEC) scams. The emails appear as if they are coming from a legitimate vendor using QuickBooks, but if the potential victim takes the bait, the invoice they pay will be to the scammer.

Worse, the payment request can require that the payee use ACH (automated clearing house) method, which requires the payee to input their bank account details. So, if the victim falls for the scam, the criminal now has their bank account information. Not good.

Note: Some other QuickBooks scam warnings will tell you that QuickBooks will never ask for your ACH or banking details. This is not completely true. QuickBooks, the company and its support staff, never will, but QuickBooks email payment requests often do. Warn your users in Accounting.

CONTINUED at the KnowBe4 blog with both legit and malicious example screenshots:
https://blog.knowbe4.com/beware-of-quickbooks-payment-scams

Hackers have begun adapting to wider use of multi-factor authentication

Proofpoint researchers have found that “phish kits” available for purchase online are beginning to adapt to MFA by adding transparent reverse proxies to their list of tools.