• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – GrandCrab and Ursnif Campaign Observed in the Wild
January 29, 2019
Rewterz Threat Advisory – Google Releases Security Updates for Chrome Multiple Vulnerabilities
January 31, 2019

Rewterz Threat Alert – Phishing Awareness For Employees and Customers of the Banking Industry

January 30, 2019

SEVERITY: High

 

 

CATEGORY: Phishing 

 

 

ANALYSIS SUMMARY

 

 

Looking at the recent Phishing Campaigns observed attacking employees of the banking sector in Pakistan, it’s highly possible that the same Phishing Attacks are targeting customers of banks too. Therefore, it is suggested to urgently run awareness programs for employees as well as customers.

 

Phishing emails are fake emails falsely claiming identity of a legitimate organization in order to steal credentials or personal information. Phishing mainly uses popular communication tools like emails, instant messaging and peer-to-peer communication, either directly obtaining sensitive information or luring victims into visiting fake websites.

 

The fake websites usually look very similar to the legitimate websites of the respective banks and can not be detected as malicious by an unsuspecting user. The information entered on such sites like username, passwords, etc. can be used to carry out fraudulent activities like unauthenticated transactions or can be sold to fraudulent groups for further malicious activity.

 

 

IMPACT

 

 

Information Disclosure

Credential Theft

Account Compromise

Fraudulent Transactions

 

REMEDIATION

 

 

  • Do not share your account information (user name, password, account number, etc) with anyone. Your Bank already has your information and it will never demand sensitive information via email.
  • Disable all kinds of auto-download options for incoming files and documents.
  • Your account will never be closed automatically even if you have previously ignored your bank’s emails. Any email warning you about closure of your account is fake.
  • Never click a link or pop-up message received in an email to access your account. It’s likely to redirect you to a fake log-in page.
  • If you want to access your online account, carefully type the legitimate URL in the browser address bar instead of following links.
  • Set up real-time scanning for viruses and automatic updates of virus definitions.
  • Before processing transactions, Bank employees should verify all transactions directed via Alerts like SMS or email that appears to have come from the bank.
  • Be very careful while entering login information on any web page and never try to log in on a site which you did not open intentionally.
  • If you receive any email or text that looks suspicious, immediately report to the concerned bank.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.