Cyber Security News

Beware Of Callback Phishing Attacks Google Groups That Steal Login Details

Callback phishing is a two-step attack involving phishing emails and phone calls. Victims are lured into calling a bogus number in the email, where attackers impersonate legitimate entities and trick victims into divulging sensitive information or downloading malware.

The BazarCall scheme employed a text-based phishing email to lure victims into calling a malicious phone number.

The number impersonating Binance falsely claimed a withdrawal of a significant amount of money. 

However, the sender domain was not legitimate, and Binance does not use a hotline for customer support, which bypasses traditional email security measures.

Join ANY.RUN's FREE webinar on How to Improve Threat Investigations on Oct 23 - Register Here 

Text-based phishing

Spammers use text obfuscation to hide their messages from detection. Base64 encoding and invisible characters made the email appear normal while being difficult to parse, highlighting the importance of carefully examining email headers and content to identify phishing attempts.

By embedding malicious content in attachments or images, they bypass spam filters, while image-based spam uses image file extensions to hide text content.

They often use PDF, .txt, and .doc files in phishing emails to trick victims into opening malicious attachments. These attachments can contain fake invoices or other fraudulent information, leading to financial losses or identity theft.

Fake YouTube invoice

The phishing attack leverages a legitimate scheduling platform to trick victims into providing personal information disguised as a QuickBooks upgrade notification. The email prompts victims to schedule a meeting with a fake support representative. 

Con artists can obtain the victims’ contact information through the scheduling process and exploit it to launch additional attacks.

QuickBooks phishing

A Calendly link allows victims to schedule a meeting and enter their contact details, which are used for further scams. The scammer’s Calendly account contains multiple fake QuickBooks events.

Cybercriminals exploit legitimate fintech platforms to send deceptive emails. They use these platforms’ credibility to disguise malicious links and requests, luring victims into providing sensitive information or clicking on malicious links.

Callback sent using Paypal

Xero and HoneyBook, cloud-based accounting and project management platforms, are being exploited by fraudsters to send callback phishing emails. 

According to Trustwave, these emails, disguised as legitimate invoices or payment notifications, contain fake contact information and a sense of urgency to induce victims to call a bogus number.

Organizations should regularly train employees to identify and avoid phishing attempts.

These attempts often rely on social engineering tactics, which involve verifying email authenticity, avoiding unsolicited phone calls, and closely monitoring financial accounts for unauthorized activity.

How to Choose an ultimate Managed SIEM solution for Your Security Team -> Download Free Guide (PDF)

Aman Mishra

Aman Mishra is a Security and privacy Reporter covering various data breach, cyber crime, malware, & vulnerability.

Recent Posts

Threat Actors Manipulate Search Results to Lure Users to Malicious Websites

Cybercriminals are increasingly exploiting search engine optimization (SEO) techniques and paid advertisements to manipulate search…

1 day ago

Hackers Imitate Google Chrome Install Page on Google Play to Distribute Android Malware

Cybersecurity experts have unearthed an intricate cyber campaign that leverages deceptive websites posing as the…

1 day ago

Dangling DNS Attack Allows Hackers to Take Over Organization’s Subdomain

Hackers are exploiting what's known as "Dangling DNS" records to take over corporate subdomains, posing…

1 day ago

HelloKitty Ransomware Returns, Launching Attacks on Windows, Linux, and ESXi Environments

Security researchers and cybersecurity experts have recently uncovered new variants of the notorious HelloKitty ransomware,…

1 day ago

RansomHub Ransomware Group Hits 84 Organizations as New Threat Actors Emerge

The RansomHub ransomware group has emerged as a significant danger, targeting a wide array of…

1 day ago

Threat Actors Leverage Email Bombing to Evade Security Tools and Conceal Malicious Activity

Threat actors are increasingly using email bombing to bypass security protocols and facilitate further malicious…

2 days ago