CEO impersonation fraud threatening IT firms: Report | Azad Times

3 months ago 60
Google News-EN Google News-KN Telegram Facebook

Azad Times News Desk.

New Delhi: Cybersecurity researchers on Monday said they have discovered a spear impersonation campaign targeting multiple IT firms where scammers were sending WhatsApp messages to top-tier employees’ personal numbers pretending to be their CEO.

CloudSEK analysts found a spear phishing campaign targeting multiple corporations wherein a specific form of a message purportedly coming from superiors or CEOs may actually be a fraud.

In these messages, the threat actor pretends to be the company’s CEO and sends a WhatsApp message to employees (mostly top-level executives) on their personal phone numbers.

Scammers misuse CEOs’ publicly available pictures by using WhatsApp profile pictures as a social engineering tactic to convince the victim.

“The research unveiled lead generation and business information tools being misused by these scammers to extract personal phone numbers,” said a CloudSEK researcher.

The scam begins with employees receiving an SMS-based message from an unknown number allegedly impersonating a top-ranking executive from the organisation.

The reason for impersonating the top-ranking executive is to instill urgency and panic.

If the receiver of the SMS acknowledges the scammer with a response, the threat actor/scammer would request to complete a quick task. The quick tasks commonly include purchasing gift cards for a client or employee and/or wiring funds to another business.

“In some cases, the scammer may ask employees to send personal information (like PINs and passwords) to third parties, often providing a plausible reason to carry out the request,” said the report.

Threat actors often use commanding and persuasive language to convince the email victim to respond.

Senior employees of the organisation can be looked up from LinkedIn.

Threat actors then use popular sales intelligence or lead generation tools such as Signalhire, Zoominfo, Rocket Reach to gather personal identifiable information (PII) like emails, phone numbers, and more.

“These online databases of businesses have their methodologies for obtaining, verifying, and then selling the employees’ contact details of an entity,” said the report.

Read more:

Chennai: TN Cyber security on high alert as phishing attacks rise

Bengaluru: Hackers target national portal of India via phishing 

Twitter says phone spear phishing attack led to massive hack

Eight members of voice phishing ring arrested in South Korea, China

Global cybersecurity market grows 16% to reach $17.8 bn in Q3

Google News-EN Google News-KN Telegram Facebook
HTML smaller font

Azad Times.

Disclaimer: This story is auto-aggregated by a Syndicated Feed and has not been created or edited By Azad Times Staff.

This is the title of the web page
This is the title of the web page