Barracuda researchers have identified a spam campaign involving thousands of phishing emails being sent to financial and healthcare employees in the greater Boston, North Carolina, New York, Texas and Alabama areas.
The undisclosed financial and healthcare organizations that Barracuda observed being targeted are small and medium-sized companies being protected by the security company, Luis Chapetti, research and data scientist at Barracuda, told SCMagazine.com in a Monday email correspondence.
The phishing emails claim that the recipient has received a new document – the spam comes from a Gmail account, contains Google and Google Drive branding, states in the body that a “document has been attached,” and tells users to ‘Click Here' to get access to the document.
“The tell-tale giveaway is the destination URL which finds itself going to various hacked domains and never anything hosted on Google's servers,” Chapetti said, going on to explain, “It is a simple click through the email that redirects to a page that looks much like a [Google] page asking for credentials to open the document that is being shared.”
The compromised website linked to in the phishing email contains Google, TRUSTe and Norton branding and purports to be a Symantec Safe Site. Any entered credentials are sent back to the attackers, Chapetti said, adding there is a malware element to the campaign that is still being investigated.
The origin of the spam campaign has yet to be confirmed, but the attackers appear to be using a bot and have already sent out several thousand phishing emails, Chapetti said, explaining that stealing even a single set of credentials can be a significant problem.
“An attacker can gain a multitude of data [by compromising just one employee,]” Chapetti said. “Companies that deal with finances and healthcare maintain data anywhere from your bank account to Social Security to full health reports.”
To defend against this and other phishing campaigns, do not click on links in the body of emails, be careful about opening email attachments, make sure anti-virus is updated on computers and mobile devices, and mark suspicious emails as spam, Chapetti said.
