We use your sign-up to provide content in ways you’ve consented to and to improve our understanding of you. This may include adverts from us and 3rd parties based on our understanding. You can unsubscribe at any time. More info
If you get an email from delivery firm UPS claiming a parcel is out for delivery, then be warned. While it might be a genuine notification that your latest online order is in the delivery truck and on its way to your address… it could also be a fiendishly clever new scam that’s so convincing even security experts say it’s easy to be fooled.
The latest attack, which has been sent out to email addresses across the globe, suggests that UPS has an important package but experienced some difficulties delivering it.
The message asks the recipient to arrange a new delivery time and date, with the email even including an official-looking tracking number. This type of scam may not seem like anything new, but hackers are using some clever new tactics to trick unsuspecting users into thinking it’s real.
As spotted by cyber expert Daniel Gallagher, when the victim hovers their mouse over the link embedded within the email, the official UPS web address appears on the screen. Checking the URL before clicking the link is a well-known way to protect yourself from scams – since these usually use web addresses that look nothing like the real domain – but this latest attack would have most people fooled.
Gmail: Google demonstrate how to block an email address
Once clicked, the user is then instantly directed to a website that also looks just like a legitimate UPS download page. This mirror image has been made possible due to a vulnerability that makes customers believe they are visiting the official company website.
If the user continues to be tricked they will then be asked to download a document that needs to be filled in so the parcel can be delivered. However, this file is actually packed with malware that can end up wreaking havoc with PCs.
Explaining more, expert Daniel Gallagher tweeted: “Just saw one of the best phishing emails I have seen in a long time. This one is going to fool a lot of people when you have the actual @UPS website indicating “Your download will start shortly.”
Other experts have been quick to add their weight to the seriousness of the scam.
“This is a very clever attack that uses the age-old method of using a well-known organization’s name as a way to add legitimacy and make the email more trustworthy,” said Erich Kron, Security Awareness Advocate at KnowBe4.
“By hiding the download of the document with this technique and making it look like it is coming from the legitimate UPS website, the cybercriminals are more likely to get away with having people perform risky behavior, such as enabling content in the document. This attack does a good job of skirting the traditional wisdom that has people check the URL bar in an effort to look for fake websites.”
You have been warned!
Source: Read Full Article