Zoom Phishing Scams: What You Need To Know

 Zoom hosted about 10 million users late last year. It was a pretty good figure for a service that only a few people knew existed. With COVID-19 burning through the entire world, preventing people from going out of their house, the user base of the service has grown to a massive 200 million users. That’s an impressive increase. However, it also comes with a threat since cybercriminals would want to have a piece of the pie.

Cybercriminals will follow the herd since that is exactly where the money is. As Zoom’s user base continue to increase, scammers will also work double time as they try to trick users by launching phishing scams.

 

 

More Hackers Impersonate Zoom

A report by Check Point Research showed that hackers have registered nearly 2,500 domains related to Zoom from April to May this year. About 320 of these domains were considered suspicious while 32 were considered malicious.

Cybercriminals are using email in order to launch phishing emails to steal the credentials of Zoom users to spread malware. Scammers will run the phishing attacks that sent legitimate looking emails. It contains a button that says open the Zoom app. But once users click on it, a malware will be downloaded on to their device.

Everyone is at risk of Zoom attacks. However, most cases involve businesses and individuals that are related to the government, transportation, manufacturing, and telecommunications.

Signs of Zoom Scams

The first email contains a Zoom account as the subject and it comes with a welcome message that’s intended for new users that recently opened an account with the service. Scammers will try to convince users to click on a malicious link to active their account by inputting their login credentials on the fake website that is controlled by the cybercriminals, who will collect and steal your information.

The second email has missed zoom meeting on the subject line. It will try to convince you that you have missed a zoom meeting and that you can check your missed conference by clicking on a link. Once you click on that, you will be directed to a fake website where you’ll be asked to enter your Zoom credentials.

The third email targets industrial firms, technology, marketing, construction, IT, energy, and manufacturing with malware, instead of phishing Columbia SC. The email subject line says your meeting has been cancelled and that you can do a Zoom call instead. Hackers are trying to get access to your personal information, computer files, and credit card details.

What to do to avoid Zoom phishing scams?

1. Be careful when opening emails from people you don’t know. Do not reply to the email and don’t forward it to others.
2. Do not download files or click on links on an email that comes from a person or company you don’t know.
3. Update your operating system and all of the applications you have on your computer.
4. Use unique and strong passwords.
5. Zoom’s official domains are zoom.us and zoom.com. Other domains similar to these two are fake.

 

Call SpartanTec, Inc. now and let our IT experts help make sure that your business is safe from phishing attacks and other types of cyberthreats.

 

SpartanTec, Inc.
Myrtle Beach, SC 29577
(843) 420-9760
https://www.spartantec.com/

SpartanTec, Inc.
Columbia, SC 29201
(803) 408-7166
http://manageditservicescolumbia.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence

This New Malware Added An Email Attachment Stealer

Emotet's massive botnet was dormant for several months, but on July 17th, 2020, it suddenly rumbled back to life.

It started spewing out massive numbers of phishing emails aimed at installing Trickbot payloads on anyone unfortunate enough to open one of their poisoned emails. The emails are often described as invoices, manifests, and the like.

In recent days, security researchers have noted that Emotet has begun swapping Trickbot payloads out with QakBot payloads, which include the use of the ProLock ransomware strain. Whichever payload is deployed, however, security researchers have noticed something else. Emotet got another upgrade.

The upgrade takes the form of an email attachment stealer. Once installed on a target system, it will scan that target's inbox and sent folders looking for email attachments. The malware isn't picky, and will take anything, copying whatever files it finds and sending them to the command and control server so it can recycle and reuse the attachments on future phishing emails.

This may not sound like it, but is actually a devastatingly effective strategy. By using live files, the phishing emails gain a further air of authenticity. The data those files contain looks legitimate because it is legitimate in that the file was generated by someone working for a corporation and sent around to others for review.

Worse, Emotet doesn't show any signs of slowing down. This week, based on statistics compiled by the interactive malware analysis platform AnyRun, Emotet was ranked as the malware threat of the week. It was measured by uploads, with nearly ten times the total uploads as njRAT, which claimed the #2 spot.

Given the size of the Emotet botnet, this is definitely a threat to be mindful of. Make sure your IT staff is aware of the large scale, ongoing phishing Columbia SC campaign by the botnet and be sure to remind all of your employees not to open any email attachments unless they're absolutely certain where they're coming from.

Are you concerned with the security of your network? Phishing attacks are becoming more common and can put your company data at risk. SpartanTec Inc.provides you with peace of mind. We are your local Fortinet security provider. Contact us today for an assessment of your network.

SpartanTec, Inc.
Columbia, SC 29201
(803) 408-7166
http://manageditservicescolumbia.com/

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence

Don’t Fall For Office 365 Zoom Notification Phishing Email

Do you use Microsoft Office 365? Do you also use Zoom? If so, be advised that there's a new phishing campaign designed with you specifically in mind, the goal of which is to ultimately make off with your Office 365 login credentials. Since the start of the global pandemic, Zoom and other video conferencing solutions have seen an explosion in the size of their user base, given that COVID-19 forced tens of millions to work from home.

In a nutshell, here's now the new campaign works:

The hackers controlling the campaign kick things off by sending out what appear to be automated Zoom account suspension alerts. These are convincingly crafted and make it appear that your account has been compromised. The message is invariably either a carbon copy or a slight variant of the following:

"We've temporarily suspended your Zoom because your email failed to sync with our server within the past 24 hours. At this time, you will not be able to invite or join any call/meeting. Please verify your email:"

And then, just below the 'Please verify your email' bit in the body of the message, the hackers have included a button labeled 'Activate Account,' which a fair percentage of this message's recipients are clicking on.

Clicking on the button opens a browser tab and takes the email recipient to a well-designed spoof of a Microsoft Login page which asks for the user's credentials.
Naturally, if the user enters their login information here, nothing will happen except that the information will be stored in a database belonging to the cybercriminals, who will no doubt use it later.

Not long ago, the US FBI issued a warning about BEC scammers targeting users of popular cloud-based email services like Google's G-Suite and Microsoft's Office 365 to steal credentials for use in attacks down the road. This latest campaign certainly seems to add an exclamation point to the end of that warning. Stay on your guard and make sure your employees are aware.

Call SpartanTec, Inc. now and let our team of IT specialists set up the appropriate cybersecurity measures that will help keep scammers and phishing Columbia SC at bay.

SpartanTec, Inc.
Columbia, SC 29201
(803) 408-7166
http://manageditservicescolumbia.com/

cities served:
Columbia, West Columbia, Cayce, St Andrews, Lexington, Oak Grove