Verizon scam steals account logins — how to protect yourself now

News
By published

Phishing email pretends to be from Verizon Support

Verizon
(Image credit: Shutterstock)

Security researchers have discovered a credential phishing campaign targeting customers at US cellular network Verizon. 

According to cloud security platform Armorblox, the phishing email attempted to deceive people by masquerading as an important message sent by the support team at Verizon.

Urgent message

Armorblox claims in a blog post that the email asked customers of the carrier to read an urgent message by logging in to their online account. 

It said the perpetrators attempted to further “the sense of fear” and underline “the paucity of time” by using “Your attention is urgently required” in the subject of the email.

In the email, the cyber crooks told victims to click a link that would take them to the Verizon website. However, using a "redirection" technique, they were sent to a spoofed Verizon website where they had to part with their email, Verizon account password, email account password, and phone number.

Bypassing email security 

The researchers went on to explain that the phishing campaign was able to bypass email security mechanisms “because it didn’t follow the tenets of more traditional phishing attacks”.

Firstly, the crooks used an “unrelated parent domain” as part of the phishing campaign.

Armorblox explained: “By hosting phishing pages on unrelated parent domains after redirections, attackers are able to evade security controls based on URL/link protection and get past filters that block known bad domains.”

What also helped the crooks to evade detection was that they developed "a lookalike website with full phishing flow”. The researchers said the attackers wanted “people to fall prey to the superficial similarity of the phishing site to Verizon’s website”.

They explained: “Once targets fill in their login details (user ID and password), the phishing flow continues with another screen asking targets to enter their email address and email password. 

“This way, attackers try to steal as much information as possible from targets who have bought into the faux legitimacy of the communication.”

Finally, the hackers opted for a socially engineered phishing campaign. The researchers said:  “Unlike spray-and-pray email fraud attempts, this email was expressly created and sent to trigger the required response. 

“The sender name was “Verizon Support” and the email was titled “Your attention is urgently required”, furthering the sense of fear and underlining the paucity of time at the targets’ disposal. The email language and topic was intended to induce urgency owing to its confidential nature (a secure message from Verizon). The call to action - LOGIN HERE - is simple and effective.”

Detecting the email 

Armorblox said it detected the attack due to the "language, intent and tone of the email"; a "low communication history"; a "low domain frequency"; and a "suspicious phishing email". 

The firm added: “Based on the insights above, along with many other detection signals, Armorblox flagged the email as a credential phishing threat. The email was automatically quarantined based on predetermined remediation actions for the credential phishing detection category."

Jake Moore, a security specialist at ESET, told Tom's Guide: "Phishing emails, whether they are traditional or bespoke, still contain a few telltale signs to look out for. The incoming address is one to investigate as a must but this can be duped or compromised with some clever tools. 

"However, to mitigate compromise, it is vital that you verify the link in any communication before clicking on it which will inevitably take you to a well-crafted duplicate. It is easy to clone a website and make it look like what you would expect, however it is difficult to make the URL appear legitimate quickly so it is always worth those extra few checks before losing control of an account or personal data.”

  • More: Stay anonymous without the spend with a cheap VPN
TOPICS
Nicholas Fearn

Nicholas Fearn is a freelance technology journalist and copywriter from the Welsh valleys. His work has appeared in publications such as the FT, the Independent, the Daily Telegraph, The Next Web, T3, Android Central, Computer Weekly, and many others. He also happens to be a diehard Mariah Carey fan!