print   email   Share

Phishing Scams Hooking Family Employers

A hacking campaign that has gone on for months spreads malware through fake updates on compromised websites.

Hackers have infiltrated thousands of websites that use a variety of content management systems, according to expert Malwarebytes. The hackers then display authentic-looking messages, prompting users to update their Firefox, Chrome, or Flash browser. If a user downloads the update, his or her device is infected with banking malware and remote access trojans.

The sophisticated malware only sends the fake update notification to each user once, which makes it appear less suspicious.

Cybersecurity experts report malware campaigns that use compromised websites have become more common over the past decade. Computer support scams often use compromised sites, but now hackers are also taking over websites in order to spread cryptocurrency mining malware. Dan Goodin "Thousands of hacked websites are infecting visitors with malware" arstechnica.com (Apr. 11, 2018).


Commentary and Checklist

Family employers can protect their data and devices by routinely training staff on cybersecurity best practices.

Recognizing phishing emails is an important loss prevention step. Email is the weakest link in cybersecurity for most family employers because they rely on email to conduct business and personal tasks. Because job duties often play into whether staff members take time to sufficiently analyze each particular email, cybercriminals know this fact and take advantage of it.

Cybercriminals often send email attachments that contain malware, which will infect your entire network if they are opened. Avoid selecting attachments or links in emails, even if the staff member knows the sender, unless the staff member is certain of what the link or attachment contains because they expected it from a prior communication with the sender. If they are unsure, they should contact the sender independently of the message (e.g., by phone, text) to verify he or she sent the message.

Never select a link or reply to an email purporting to be from a banking institution that asks you to send personal or business account information.

Be keenly aware of phishing scams. There are a number of different types of phishing scams. Many people know about and avoid advance fee scams, in which the sender claims the recipient will receive a “large sum of money” after sending bank account information.

There are, however, other dangerous phishing emails, however, like “help desk” or “email account deactivation” scams in which an email claims that an account needs to be verified by clicking on a link or it will be “deactivated”.

The following are common messages used in phishing emails:

  • "We suspect an unauthorized transaction on your account. To ensure that your account is not compromised, please click the link below and confirm your identity".
  • "During our regular verification of accounts, we couldn't verify your information. Please click here to update and verify your information".
  • "Our records indicate that your account was overcharged. You must call us within 7 days to receive your refund".
Finally, your opinion is important to us. Please complete the opinion survey: