• Office Hours : 08:00 - 17:30

X-rated phishing attacks just keep growing

Hackers are increasingly using adult material in phishing attacks to lure unsuspecting victims into clicking on links to download malware, according to new research.

In a blog post by security researchers at GreatHorn, it was found that between May 2020 and April 2021, the number of such attacks increased by 974%. Researchers said that these attacks reach across a broad spectrum of industries and appear to target based on male-sounding usernames in company email addresses.

Attackers use these X-rated phishing emails as a runup to blackmail. In these attacks, cybercriminals are tracking the identity of victims who click on their sites by using a technique called an email pass-through. The same technology enables legitimate email senders to auto-populate an unsubscribe field with a user email address. 

“Once a user clicks on a link in the email, their email address is automatically passed to the linked site. In these attacks, the cybercriminal leverages the information they gleaned in order to set up a second stage. Individuals who clicked on links to compromising material could be targeted in the second attack to extort the individual,” said researchers.

Researchers highlighted two campaigns where this tactic is used.

In the first one, hackers claim to be a woman that wants to meet the victim. Clicking on the link in the email takes the victim to a website with photos, this site is classified as Malicious by Google Safe Browsing. This then directs the victim to a second site, which looks like a dating website.

Related Resource

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Prevent fraud and phishing attacks with DMARC - whitepaper from MimecastPrevent fraud and phishing attacks with DMARC - whitepaper from MimecastDownload now

“It is likely a fake site designed to hook users into providing payment information. User data gleaned in this way will be transmitted to cybercriminals, who will use it for various malicious purposes, such as money withdrawal, blackmailing, or committing further frauds,” said researchers.

In the second example, a link in the phishing email sends the victim to a website with X-rated images. Victims are asked to confirm a Zip code to find individuals in their area. This website also tries to make victims provide payment information.

“User data gleaned in this way will be transmitted to cybercriminals, who will use it for various malicious purposes, such as money withdrawal, blackmailing, or committing further frauds,” said researchers.

Featured Resources

Consumer choice and the payment experience

A software provider’s guide to getting, growing, and keeping customers

Download now

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Download now

Business in the new economy landscape

How we coped with 2020 and looking ahead to a brighter 2021

Download now

How to increase cyber resilience within your organisation

Cyber resilience for dummies

Download now

See the original article here: ITPro