Cyber Security News

Beware Of Callback Phishing Attacks Google Groups That Steal Login Details

Callback phishing is a two-step attack involving phishing emails and phone calls. Victims are lured into calling a bogus number in the email, where attackers impersonate legitimate entities and trick victims into divulging sensitive information or downloading malware.

The BazarCall scheme employed a text-based phishing email to lure victims into calling a malicious phone number.

The number impersonating Binance falsely claimed a withdrawal of a significant amount of money. 

However, the sender domain was not legitimate, and Binance does not use a hotline for customer support, which bypasses traditional email security measures.

Join ANY.RUN's FREE webinar on How to Improve Threat Investigations on Oct 23 - Register Here 

Text-based phishingText-based phishing
Text-based phishing

Spammers use text obfuscation to hide their messages from detection. Base64 encoding and invisible characters made the email appear normal while being difficult to parse, highlighting the importance of carefully examining email headers and content to identify phishing attempts.

By embedding malicious content in attachments or images, they bypass spam filters, while image-based spam uses image file extensions to hide text content.

They often use PDF, .txt, and .doc files in phishing emails to trick victims into opening malicious attachments. These attachments can contain fake invoices or other fraudulent information, leading to financial losses or identity theft.

Fake YouTube invoice

The phishing attack leverages a legitimate scheduling platform to trick victims into providing personal information disguised as a QuickBooks upgrade notification. The email prompts victims to schedule a meeting with a fake support representative. 

Con artists can obtain the victims’ contact information through the scheduling process and exploit it to launch additional attacks.

QuickBooks phishing

A Calendly link allows victims to schedule a meeting and enter their contact details, which are used for further scams. The scammer’s Calendly account contains multiple fake QuickBooks events.

Cybercriminals exploit legitimate fintech platforms to send deceptive emails. They use these platforms’ credibility to disguise malicious links and requests, luring victims into providing sensitive information or clicking on malicious links.

Callback sent using Paypal

Xero and HoneyBook, cloud-based accounting and project management platforms, are being exploited by fraudsters to send callback phishing emails. 

According to Trustwave, these emails, disguised as legitimate invoices or payment notifications, contain fake contact information and a sense of urgency to induce victims to call a bogus number.

Organizations should regularly train employees to identify and avoid phishing attempts.

These attempts often rely on social engineering tactics, which involve verifying email authenticity, avoiding unsolicited phone calls, and closely monitoring financial accounts for unauthorized activity.

How to Choose an ultimate Managed SIEM solution for Your Security Team -> Download Free Guide (PDF)

Aman Mishra

Aman Mishra is a Security and privacy Reporter covering various data breach, cyber crime, malware, & vulnerability.

Recent Posts

Ex-ASML Russian Employee Smuggled Trade Secrets to Moscow via USB

A former employee of Dutch semiconductor firm ASML, identified as German A. (43), stands accused…

2 hours ago

Critical Apache Parquet Vulnerability Allows Remote Code Execution

A severe vulnerability has been identified in the Apache Parquet Java library, specifically within its parquet-avro module.…

2 hours ago

Halo ITSM Vulnerability Lets Attackers Inject Malicious SQL Code

A critical security flaw has been discovered in Halo ITSM, an IT support management software widely…

4 hours ago

Australian Pension Funds Hacked: Members Face Financial Losses

Several of Australia’s largest superannuation funds have been targeted in a coordinated cyberattack, leading to…

4 hours ago

Frida Penetration Testing Toolkit Updated with Advanced Threat Monitoring APIs

In a significant update to the popular dynamic instrumentation toolkit Frida, developers have introduced powerful…

5 hours ago

OpenVPN Flaw Allows Attackers Crash Servers and Run Remote Code

OpenVPN, a widely-used open-source virtual private network (VPN) software, has recently patched a security vulnerability…

6 hours ago