I would like to raise everyone’s attention to a series of official looking Phishing attempts on one of my clients. Having alerted the relevant people, one more came forward to say that they had received a message as well.
This is how it works
You receive a short email to say that your email account has been suspended due to security issues that have been detected. Of course you would wish to rectify this so would read it.
The email is personalised and appears to be addressed to you, because the first part of your email address contains your name. They harvest this part and place it as a field in the email. So you might see something like Dear mark.wingrove, ….
Note the lack of capitalisation, and the “.” in the name. That is a giveaway.
Within the message body is a statement which claims the IT/ Support department for your organisation has detected a problem with the security of your email address and you need to act within the next 48hrs otherwise your email address will be permanently disabled.
There is a link you need to click on to resolve the problem.
What is Phishing
Phishing is a method used by hackers and other bored people to present a form to you and invite you to enter your email address and password into the form. I wrote about this a few years back with an example and how it all worked. You can find it here.
You assume the website/page you are taken to is legitimate and enter the information into the form anticipating you will resolve the problem mentioned in the email.
What actually happens is the form data is forwarded to an anonymous (meaning difficult to trace) email account which the hacker is using. They will then use your email address and password to access your account and take it over.
Take care of your security
Once the hacker has got into your email account, now consider how you use your email account and how it is connected to everything else, and you will get an idea why they do it.
I have had examples from a a few years ago where a gmail account was compromised in this way, and the hacker got into a website because the gmail account was associated with a website.
About this particular case
In this instance, it looks like there was a small number of personalised email account addresses on the website. These are under links encouraging people to contact an individual directly. So someone or something had harvested these from the site.
Normally a generic email account is used and mail goes to this mailbox for sorting later.
What to watch out for
If you receive any email, expected or not asking you to follow a link to set up your account, unfreeze your account, or anything to do with entering your account details somewhere do not click on it.
If you were expecting an email like this (for a legitimate reason) then independently go to your account and check it. Do not trust any links sent to your email account in emails especially if they are not solicited. They are likely to be fraudulent.
About your IT department
I am not your IT department, but if I was aware of a problem with your account I would contact you directly. Even if you have a third party looking after your email accounts, they will probably contact you directly, or through their contact in your organisation, it would be very unusual to receive an automated message.
Free Account users
For those of you using Gmail (Googlemail), Yahoo or Hotmail, you are particularly vulnerable. If you loose control of your account, then you will probably lose it for a month or more. Because you are not paying for your email account, it not so surprising that there is not a human you can call to resolve it. You enter an automated process which takes some time to resolve. If that was your only account, or main account, you are now in trouble because you can no longer send or receive mail once the account is suspended. I recommend that if you fall in this category you look at adding 2 factor authentication on your account which will help prevent any third party from taking it over.
If you are using an email account associated with your hosting or domain name, then if it is taken over, it is easy to grab back again. If it happens to you, tell me or your email partner immediately you are aware of the event.