March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – GrandCrab and Ursnif Campaign Observed in the Wild
January 29, 2019
Rewterz Threat Advisory – Google Releases Security Updates for Chrome Multiple Vulnerabilities
January 31, 2019
Rewterz Threat Alert – GrandCrab and Ursnif Campaign Observed in the Wild
January 29, 2019
Rewterz Threat Advisory – Google Releases Security Updates for Chrome Multiple Vulnerabilities
January 31, 2019
SEVERITY: High
CATEGORY: Phishing
ANALYSIS SUMMARY
Looking at the recent Phishing Campaigns observed attacking employees of the banking sector in Pakistan, it’s highly possible that the same Phishing Attacks are targeting customers of banks too. Therefore, it is suggested to urgently run awareness programs for employees as well as customers.
Phishing emails are fake emails falsely claiming identity of a legitimate organization in order to steal credentials or personal information. Phishing mainly uses popular communication tools like emails, instant messaging and peer-to-peer communication, either directly obtaining sensitive information or luring victims into visiting fake websites.
The fake websites usually look very similar to the legitimate websites of the respective banks and can not be detected as malicious by an unsuspecting user. The information entered on such sites like username, passwords, etc. can be used to carry out fraudulent activities like unauthenticated transactions or can be sold to fraudulent groups for further malicious activity.
IMPACT
Information Disclosure
Credential Theft
Account Compromise
Fraudulent Transactions
REMEDIATION
- Do not share your account information (user name, password, account number, etc) with anyone. Your Bank already has your information and it will never demand sensitive information via email.
- Disable all kinds of auto-download options for incoming files and documents.
- Your account will never be closed automatically even if you have previously ignored your bank’s emails. Any email warning you about closure of your account is fake.
- Never click a link or pop-up message received in an email to access your account. It’s likely to redirect you to a fake log-in page.
- If you want to access your online account, carefully type the legitimate URL in the browser address bar instead of following links.
- Set up real-time scanning for viruses and automatic updates of virus definitions.
- Before processing transactions, Bank employees should verify all transactions directed via Alerts like SMS or email that appears to have come from the bank.
- Be very careful while entering login information on any web page and never try to log in on a site which you did not open intentionally.
- If you receive any email or text that looks suspicious, immediately report to the concerned bank.