Fake Instagram Message Attacks Breach Email Security
Cyber phishing attack have targeted 22,000 students attending US national education institutions with a campaign that impersonated a popular social media platform. These cyber attackers targeted students with a sophisticated phishing campaign that impersonated Instagram.
The unusual aspect of the campaign is that they used a valid domain in an effort to steal credentials, bypassing both Microsoft 365 and Exchange email protections in the process.
The information comes from security experts at Amorbiox, who highlighted the new threat in a recent advisory notice. “Attackers targeted employees at a national institution within the Education Industry, with an email attack that spoofed the global social media brand Instagram in an attempt to steal victims’ user credentials,”
According to Armorblox, the subject of this email encouraged victims to open the message. "The goal of this subject was to induce a sense of urgency in the victims, making it seem an action needed to be taken in order to prevent future harm."
The phishing campaign consisted of an initial email that encouraged the victims to open the message, inducing a sense of urgency in the victims and making it appear as though action needed to be taken in order to protect their accounts.
The email appears to have come from Instagram support as the sender’s name, Instagram, and email address matched Instagram’s legitimate credentials. The attack was engineered to contain personal information about the recipient, such as his or her Instagram user handle. This established trust between the recipient and the sender of the email, as the message appeared to be legitimate email communication from Instagram.
Once victims clicked on a link in the email, a fake landing page opened that included Instagram branding and details. The page was designed to steal the user’s credentials.
Armorblox: Dark Reading: Oodaloop: Infosecurity- Magazine: ITSecurityGuru:
You Might Also Read:
