Beware of Google Alerts data-breach notifications -- they could be a scam

News
By last updated

Spoof warnings send users to web pages filled with scams and malware

google alerts could be data scams
(Image credit: dennizn / Shutterstock.com)

Cybercriminals are distributing spoofed data-breach notifications that are used to scam unsuspecting recipients and infect their devices with malware.

Fraudsters are using malicious SEO methods, Google sites and spam pages to deceive and scam users, according to a report by Bleeping Computer.

The crooks have been sending fake data-breach messages from companies like Chegg, EA, Canva, Dropbox, Hulu, Ceridian, Shein, PayPal, Target, Hautelook, Mojang, InterContinental Hotels Group and Houzz.

To spread the fake notifications, the crooks published new web pages and compromised existing sites with terms like “data breach”. These were then picked up by Google Alerts, a service that allows users to track any keyword.

The notifications used subjects like “Target data breach”, “Dropbox data breach” and “Paypal security breach 2020” to get the attention of users. By clicking on any of these links, users would be directed to web pages containing fake giveaways, advertisements for browser extensions and other scams.

In some cases, the notifications weren’t easily identifiable as scams because they displayed “page not found” warnings and text describing fake data breaches.

To avoid falling victims to these scams, don't install any browser extensions, plugins or software that these alerts may suggest. In many case, you'll just be asked to fill out a survey to see the "notification," which is harmless as long as you don't have to give up any personal information.

Thousands of topics

In its investigation, Bleeping Computer also discovered a directory of 2,000 text files that used particular keywords and phrases to appear in Google Alerts. Most of these were created in this past week, but the oldest can be traced back to July 31, 2018.

All of this information has been taken from public sources and is based on questions people have, with topics including software products, DIY, vaping, breeding dogs and hardware. 

Another fake message urged people to update their Adobe Flash browser plugins, appeared in Google Chrome and Mozilla Firefox and sent users to a fake iPhone 11 competition. 

Jake Moore, a security specialist at ESET, told Tom’s Guide: “Bad actors are increasingly getting better at obfuscating their illicit means. Attackers continue to evolve their tactics into lending a false sense of security on their prey and they are extremely good at this. 

"They use well known brands to create a sense of misplaced security manipulating the victims into clicking on malware unbeknownst to them. The answer remains in constant vigilance and not to be so quick to click around on a site even if it is thought to be trusted." 

  • Read more: Stay protected online for less with the best cheap VPN
TOPICS
Nicholas Fearn

Nicholas Fearn is a freelance technology journalist and copywriter from the Welsh valleys. His work has appeared in publications such as the FT, the Independent, the Daily Telegraph, The Next Web, T3, Android Central, Computer Weekly, and many others. He also happens to be a diehard Mariah Carey fan!