Social Media Networks - A Phisher’s Paradise

Feasting their eyes on social media

• Impersonation is a prime technique used in different social engineering attacks. Scammers pretend to be someone with authority, denigrate people, tarnish brand reputations, or con followers into committing fraudulent activities.
• Cybercriminals are leveraging social media networks to launch phishing attacks, befriending their targets to make them divulge personal information. Using that collected data, criminals create a false identity for committing fraud. 
• Often phishing scammers employ fake landing pages and dupe social media users into logging in using their credentials. After gaining access to users’ accounts, they launch attacks from their accounts to target their friends and other contacts.
• Exploiting short URLs is one of the common techniques used in phishing attacks, especially on platforms such as Twitter. Criminals tend to hide malicious links and the C2 infrastructure with the help of Twitter’s URL shortener.
• Hackers are launching romance scams, targeting people looking for companionship. In such phishing scams, they replicate accounts of people, usually from the military.

Recent phishing campaigns via social media platforms

• The Iranian APT group, Charming Kitten, was seen impersonating journalists via WhatsApp and LinkedIn. The attackers are approaching targets on both the platforms, tricking victims into clicking on a malicious link—which leads to a phishing page—to steal credentials.
• In a phishing campaign, Turkish-speaking cybercriminals are sending messages to Instagram users on the platform itself to pilfer their Instagram and email credentials. Pretending to be the Instagram Help Center, the attackers claim a copyright violation complaint being filed against the account holder and that their account might be deleted.
• The North Korean APT group, Lazarus, conducted a phishing campaign targeting cryptocurrency firms via LinkedIn messages. The goal of the campaign was to harvest credentials for accessing online bank accounts or cryptocurrency wallets.

There’s no time to waste