This is a security awareness newsletter meant for internal distribution. Feel free to grab and share with your company internally.
Steer Clear of Job Scams: Tips for New Graduates
Be cautious of job scams targeting new graduates. Here are some key takeaways to protect new graduates:
Be skeptical of unsolicited offers, especially those coming out of the blue. Legitimate companies typically have established recruitment channels.
Guard your personal information. Don't share sensitive details like bank accounts or Social Security numbers in initial communications.
High starting salaries with minimal experience requirements are often red flags. Scammers lure victims with unrealistic promises.
Do your research! Verify the legitimacy of companies by checking their websites and contacting them directly through listed channels.
Don't hesitate to leverage school resources. Career centers can offer guidance and help spot scams.
Trust your gut. If something feels off about a job offer, it probably is. Don't be pressured into rushing forward.
By following these tips, graduates can navigate a job search with confidence and avoid falling victim to scams. Remember, protecting your personal information and conducting thorough research are crucial steps towards landing a safe and rewarding job opportunity.
Love on the Rocks? Watch Out for Verification Scams!
Looking for love online? While dating apps can be a great way to meet someone special, be on the lookout for scammers trying to exploit your emotions. The FBI recently issued a warning about verification scams targeting dating app users.
Here's the lowdown:
The Scam: Scammers lure you in with the promise of a secure dating experience through a "verification process."
The Hook: They'll often move the conversation to a private platform and then send a link to a fake website offering a "free" verification service.
The Bait and Switch: This website is designed to trick you into signing up for a fraudulent monthly subscription .
Don't let love blind you! Here are some tips to stay safe:
Be wary of requests to move conversations off the dating platform. Legitimate dating apps have robust security features.
Don't click on suspicious links, especially those promising verification. Verify information directly through the dating app's support channels.
If something sounds too good to be true, it probably is. Don't fall for promises of guaranteed love matches or enhanced security behind a paywall.
Remember, online dating requires a healthy dose of skepticism. Trust your instincts, and prioritize your safety!
Shein Phishing Alert: Protect Your Fashion Finds and Login Info!
Calling all fashionistas! Watch out for phishing emails spoofing popular online retailer Shein. These emails aim to steal your login credentials and compromise your online shopping accounts.
Here's the Scheme:
The Lure: The email might claim you have an unclaimed order, exclusive discounts, or a problem with your account.
The Trap: Clicking a link in the email takes you to a fake Shein login page designed to steal your username and password.
Don't Fall for Fake Fashion Frenzy!
Beware of unsolicited emails, even if they look official. Shein won't contact you about account issues through unexpected emails.
Inspect sender addresses carefully. Legitimate Shein emails will come from a Shein domain address, not a random one.
Hover over links before clicking. See if the link's destination matches the displayed text. Don't enter your login details on suspicious websites.
Always access your Shein account directly through the official website or app. Don't rely on links in emails.
By staying vigilant, you can protect your hard-earned cash and sensitive information. Happy (and secure) shopping!
North Korean Threat Actors Targeting Developers with Fake Job Interviews
A new social engineering attack campaign is targeting software developers. This campaign is likely associated with North Korean threat actors. The attackers are sending fake job interviews that contain malicious software.
How the Attack Works
The attackers will send a seemingly legitimate job offer email to a software developer. The email will contain a link to a malicious website or a document that, when opened, will download malware onto the victim's computer. The malware is a Python-based RAT (Remote Access Trojan) that can steal information from the victim's computer, such as files, keystrokes, and browsing history.
How to Protect Yourself
Be cautious of unsolicited job offers, even if they seem to come from a legitimate company.
Do not click on links or open attachments in emails from unknown senders.
Verify the legitimacy of a job offer by contacting the company directly.
Maintain a security-focused mindset during job interviews. If something seems too good to be true, it probably is.
Monitor your computer for suspicious activity, such as unknown programs running or unusual network traffic.
Don't Let Ransomware Hit You Where It Hurts: Protecting Your Family From SIM Swapping
Cybercriminals are getting more personal in their attacks. A recent report from Mandiant highlights a disturbing trend: ransomware attackers targeting executives by SIM swapping their children's phones.
What is SIM Swapping?
SIM swapping is when a scammer takes control of your phone number by transferring it to a new SIM card. This allows them to receive your calls, texts, and potentially even two-factor authentication codes.
How Can You Protect Yourself?
Be Wary of Unusual Activity: Monitor your phone bill for any suspicious changes, like increased data usage or new charges.
Enable Two-factor Authentication (2FA): But not with SMS verification! Use a dedicated authentication app instead.
Don't Share Personal Information Online: This includes your birthday, address, and even your child's school name.
Talk to Your Family: Educate them about SIM swapping and the importance of online safety.
Contact Your Carrier: Ask about SIM swapping security measures and how to add additional protections to your account.
For More Information:
How to Protect Yourself from SIM Swapping: https://consumer.ftc.gov/consumer-alerts/2019/10/sim-swap-scams-how-protect-yourself
Alert: Cybercriminals Exploiting Docusign with Sophisticated Phishing Scams
Summary: Cybercriminals are increasingly targeting Docusign users by distributing customizable phishing templates on cybercrime forums. These templates closely mimic legitimate Docusign emails, luring recipients into providing sensitive information or clicking malicious links. These attacks facilitate various malicious activities, including credential theft and business email compromise (BEC) scams.
Key Indicators of Docusign Phishing Emails:
Sender's Email: Ensure it originates from the docusign.net domain.
Greetings: Genuine emails use your name, not generic salutations.
Security Codes: Authentic codes are long and complex.
Links: Hover over links to check if they lead to docusign.net.
Direct Access: Use Docusign's secure document access instead of clicking links.
Prevention Tips:
Always verify the sender's email address.
Avoid clicking on suspicious links and attachments.
Contact the sender through trusted channels if in doubt.
Growing Confidence Among CISOs Despite Rising Cyber Threats
Overview: According to Proofpoint's 2024 Voice of the CISO report, 70% of CISOs feel at risk of a cyber attack, yet only 43% feel unprepared—a significant improvement from previous years. Despite this growing confidence, human error remains a critical vulnerability, with 74% of CISOs identifying it as a top concern. Encouragingly, the adoption of AI-powered solutions and enhanced employee education are seen as key strategies to mitigate these risks. However, challenges such as ransomware, malware, and employee turnover continue to test cybersecurity resilience.
Key Points:
Rising Confidence: 43% of CISOs feel unprepared for attacks, down from 61% last year.
Human Error: 74% of CISOs see human error as the biggest vulnerability.
AI Solutions: 87% are deploying AI to combat human-centric threats.
Top Threats: Ransomware, malware, and email fraud are major concerns.
Takeaway: Continuous improvement in AI adoption and employee training is vital for bolstering cybersecurity defenses.
New Social Engineering Scheme by Black Basta Ransomware Group
Overview: The Black Basta ransomware group has launched a new mass spam and social engineering campaign, targeting various industries. The attackers flood users' emails with spam and then pose as IT support, convincing victims to download remote access tools like Quick Assist or AnyDesk. This grants the attackers initial access to deploy ransomware and steal credentials.
Key Points:
Spam Overload: Victims receive thousands of spam emails.
Impersonation: Attackers pose as IT support to gain trust.
Remote Access: Tools like Quick Assist and AnyDesk are used to gain access.
Prevention: Block newly registered domains and restrict remote management tools.
Takeaway: Stay vigilant against unsolicited IT support offers and ensure employees are aware of this tactic.
From Phish to Phish Phishing: How Email Scams Got Smart
Phishing scams have evolved dramatically over the years, becoming more sophisticated and harder to detect. Here are key points from Check Point's recent article on how email scams have become smarter:
Evolution of Phishing Tactics:
Old vs. New: Early phishing attempts were often easy to spot due to obvious mistakes like all-caps subject lines, poor grammar, and bad spoofing. Modern phishing emails, however, are much more convincing, using official-looking logos and professional language.
Advanced Spoofing: Attackers now use advanced techniques to spoof emails, making them appear as if they come from trusted sources such as banks, government agencies, or company executives. This creates a sense of urgency and legitimacy.
Techniques and Vectors:
Email and Attachments: Phishing emails often include links to fake websites or attachments that require personal information. These can lead to data theft or malware infections.
Vishing and SMiShing: Phishing is not limited to emails. Attackers use voice phishing (vishing) and SMS phishing (SMiShing) to trick victims into revealing sensitive information over the phone or through text messages.
Common Scams:
Ransomware Delivery: A significant number of phishing emails now deliver ransomware, locking victims' files and demanding a ransom for their release.
Fake Alerts: Emails claiming to be from PayPal, Wells Fargo, or even the FBI often contain urgent messages about account issues, prompting victims to click on malicious links or provide personal information.
Preventive Measures:
Stay Vigilant: Always verify the sender’s email address and look for signs of phishing, such as generic greetings and urgent requests for personal information.
Check Links and Attachments: Hover over links to see their true destination and avoid clicking on suspicious attachments.
Use Security Tools: Employ email filtering and antivirus software to help detect and block phishing attempts.
By staying informed and cautious, you can protect yourself and your organization from falling victim to these increasingly sophisticated email scams.
Cybercriminals are exploiting unsuspecting individuals with a new scheme known as the "Piano Scam." Victims receive emails offering a free piano due to a family death, but they are asked to pay shipping fees through fake shipping companies. These scammers also collect personal information. Protect yourself by verifying the sender, avoiding clicking on unknown links, and reporting suspicious emails.
Key Points:
Advance Fee Fraud (AFF): The scam involves requesting a small upfront fee for a larger promised reward, in this case, a free piano.
Payment Methods: Scammers request payment via Zelle, Cash App, PayPal, Apple Pay, or cryptocurrency.
Personally Identifiable Information (PII): Scammers collect names, addresses, and phone numbers.
Indicators of Compromise: Emails from unknown senders, requests for upfront payments, and varied sender addresses.