New phishing kit picks on Verizon Wireless customers to swoop credentials

• The phishing kit was designed particularly to target mobile devices offered by Verizon.
• Phishing links pushed out by the kit impersonated Verizon Customer Support to solicit credentials from customers.

A sophisticated phishing kit has been found to corner Verizon customers to steal login credentials. Lookout, a security firm which specializes in providing software solutions for mobile devices, discovered this kit recently.

In a blog published by the firm, three different phishing campaigns were carried out to research deeply on Verizon’s customer service in addition to targeting victims.

Worth noting

• Phishing campaigns start by targeting Verizon customers with links that disguise as coming from Verizon Customer Service.
• The phishing link in the kit significantly looks like a legitimate Verizon Customer Service page but appears shoddy when viewed from a desktop/laptop. It even dons a banner of Verizon mobile app to appear more legitimate.
• The security firm found out that the phishers tried to spoof a Verizon address meant for customer service.
• In the blog, Lookout also mentioned that the Verizon ECRM server housed three different phishing campaigns in the past three months.

A formidable attack

Jeremy Richards, Principal Security Researcher at Lookout told that the phishing campaigns were more than a recce. “This campaign shows that not only did the attackers research what Verizon’s infrastructure looks like, but that they were relentless in their attack. We lack visibility into the effectiveness of this particular campaign, but for anyone that fell victim there is a very real risk of identity theft or account takeover,” Richards warned in the blog.

All in all, Lookout has documented a total of 51 Verizon customer phishing domains that were used by the phishing kit.