Eskenzi PR ad banner Eskenzi PR ad banner
  • About Us
Friday, 27 January, 2023
IT Security Guru
Eskenzi PR banner
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
IT Security Guru
No Result
View All Result

Phishing Email Alert: Apple Pay Impersonated In Sophisticated Attack.

by The Gurus
October 18, 2018
in Scam Of The Week
Image of Apple
Share on FacebookShare on Twitter

As cybercrime evolves and becomes more complex, cybercriminals are increasingly mimicking well-known brands and trusted companies, brandjacking them in a bid to infect computer systems and to steal sensitive data.

Apple Pay is the latest victim, with legitimate-looking receipts purporting to be from the company hitting inboxes Thursday morning (AEDT). These are actually phishing emails designed to steal confidential personal and billing credentials, like the victims’ Apple ID and password, mobile phone numbers, credit card data, and similarly valuable information.

Titled ‘ApplePay (Automatic Payment)’, the email uses a display name of ‘[email protected]’. The body of the text appears as an official copy of an Apple Pay receipt, informing recipients of an ‘integrated purchase’.

Several of the links within the email lead to a copy of the Apple login page. The page first asks the user to enter their Apple ID email address and password. Having input their Apple ID information, victims are led to another page informing them their account is locked. Users who click on the ‘unlock your account’ link are led to another page purporting to be from Apple, requesting their billing details.

Another page then follows, requesting ‘additional information’ from users. This includes their credit card information. As a last step, unsuspecting recipients are asked to enter a one-time authorisation code sent to their mobile numbers. Having undergone all the above steps, users are finally led to a page informing them their account is ‘verified’ and they are redirected to the legitimate Apple login page.

MailGuard has determined that this email actually comes from one of two compromised accounts, and understands the domain used to host the fake Apple site was registered in the past 24 hours for the purpose of this scam.

The inclusion of Apple Pay’s logo and branding, along with the presence of a seemingly secure and ‘official’ multiple-step procedure to verify accounts, are tools adopted to boost the authenticity of the email. Having convinced recipients that the email is actually from Apple Pay, cybercriminals exploit the trusted reputation of the brand to trick the company’s immensely large customer base into divulging their confidential data.

What is “phishing?”
Phishing is the practice of tricking email recipients into revealing personal information that criminals can exploit for gain. Phishing emails go to a wide group of random people; it’s like a fisherman casting a wide net to see what he can catch. The attackers know that not everyone will respond, but they know that if they send enough emails out somebody will probably take the bait.

A phishing attack message will typically include a link that will send the unwary victim to a fake login website. Once there, the user will be asked to enter username and password data which will be automatically captured by the phishing page. Scammers use phishing pages to collect login credentials for email accounts, bank accounts, and a wide range of other online services.

Commenting on the scam, Craig McDonald, CEO & Founder of MailGuard, an Australian cybersecurity firm said:

“This is very cleverly executed scam. Not only does it mimic a major household brand like Apple, that nearly everyone online has a relationship with, but the mechanics it employs to extract sensitive data and credentials are also executed seamlessly.”

“Starting with a simple email receipt, the email entices curious recipients to click through to authentic looking landing pages that trick users into handing over contact details, birth dates, mobile phone numbers and credit card info. All extremely useful to perpetrate identity fraud, or for re-sale on the dark web.”

“Anyone that receives an Apple email should be extremely vigilant and check its authenticity before providing any confidential information online.”

[tpr-boilerplate company=’null’]

FacebookTweetLinkedIn
ShareTweetShare
Previous Post

Optiemus Infracom Limited Partners With EQUIIS Technologies To Strengthen Enterprise Security Solutions.

Next Post

Alert Logic announces new Partner Connect Program

Recent News

#MIWIC2022: Carole Embling, Metro Bank

#MIWIC2022: Carole Embling, Metro Bank

January 26, 2023
Lupovis eliminates false positive security alerts for security analysts and MSSPs

Lupovis eliminates false positive security alerts for security analysts and MSSPs

January 26, 2023
Threat actors launch one malicious attack every minute

Threat actors launch one malicious attack every minute

January 25, 2023
The Salt Security API Protection Platform is Now Available on Google Cloud Marketplace

The Salt Security API Protection Platform is Now Available on Google Cloud Marketplace

January 25, 2023

The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY

Follow Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

This site uses functional cookies and external scripts to improve your experience.

Privacy settings

Privacy Settings / PENDING

This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.

NOTE: These settings will only apply to the browser and device you are currently using.

GDPR Compliance

Powered by Cookie Information