The Weekly Top 3 are the three most relevant news stories for the week that are related to phishing scams and activities reported in the media, security blogs and security magazines on the Internet. This week, we look at phishing activities related to Apple, Brunswick and a one dollar password sale.
A new phishing scam targeting Apple’s customers in the United Kingdom has surfaced early this week. The victims of this phishing scam stated that they were receiving texts from an unknown number claiming to be from “iSupport”. The phishing message warned their recipients that their iCloud accounts were deactivated. The message then requested that they clicked on the link in the message so as to reactivate the account. Once the victim clicked on the link, they were forwarded to a fake Apple login page that would ask them for their Apple ID and password. This page was used to steal the victim’s Apple ID credentials. Click on the link below to read more.
The Brunswick Corporation recently informed the public that they were a victim of an incident involving a phishing attack. As a result, the scammers were able to potentially obtain W-2 tax information of their current and previous employees. No further details were given about the phishing attack. However, Brunswick stated that they are offering credit monitoring and identity theft insurance to all persons affected by this incident. Click on the link below to read more.
http://boatingindustry.com/news/2016/05/02/brunswick-reports-phishing-incident/
Security researchers from Hold Security recently discovered hacker on a Russian forum attempting to sell a trove of over 1.17 billion stolen e-mail credential records. Strangely enough, the hacker only wanted 50 roubles (i.e. less than USD $1.00) for the entire database. The security firm was able to trade favors with the hacker in order to obtain the records, which were analyzed by the firm. The analysis of these records showed that the majority of them came from Mail.ru accounts, while the rest came from Gmail, Microsoft and Yahoo. German and Chinese e-mail provider accounts were also found in the records. The stolen credentials can be used to execute phishing campaigns on the affected users, which can include account take-over and inbox reconnaissance. Click on the link below to read more.
http://uk.reuters.com/article/us-cyber-passwords-idUKKCN0XV1I6
APHC