AI DevwWrld CyberDSA Chatbot Summit Cyber Revolution Summit CYSEC Global Cyber Security & Cloud Expo World Series Digital Identity & Authentication Summit Asian Integrated Resort Expo Middle East Low Code No Code Summit TimeAI Summit

New attack strategies in Italy: the adaptability of phishing

Evolution of cyber attacks: discovering personalized phishing tactics

CERT-AgID reported an evolution in phishing methods called "adaptive phishing", which customizes email attacks to increase their effectiveness, using authentic victim logos and websites.

This pill is also available in Italian language

“Adaptive phishing” emerges as a sophisticated evolution of phishing attacks, reported by CERT-AgID. This method is characterized by the ability to dynamically modify the contents of fraudulent pages, depending on the target organization, exploiting the particular email domain. This allows attackers to increase the effectiveness of their deception, making it personalized and therefore potentially more insidious.

Innovations in the practice of adaptive phishing

Initial use of this technique included the creation of fake authentication forms enriched with a company logo and name, obtained via the Clearbit Logo API. Progressive refinement has led to the deployment of additional services such as thum.io, which takes authentic screenshots of victim sites, using the domain name. These screenshots are then displayed as wallpaper, increasing the realism of the attack and making it difficult for users to detect.

Telegram as a tool for cybercriminals

An in-depth analysis revealed that the credentials obtained through the fake login pages are stored on the server hosting the fraud and simultaneously sent to a bot on Telegram. This detail highlights the versatility and danger of adaptive phishing attacks, as they can exploit legitimate platforms for the management and transfer of stolen information.

Importance of prevention in combating adaptive phishing

Adaptive phishing poses a significant threat to the integrity of corporate information, as it aims to obtain sensitive data, such as login credentials. It is therefore crucial for business entities and users to adopt preventive strategies and maintain a high guard. In the meantime, CERT-AgID has taken proactive measures, requesting the deactivation of malicious domains and communicating the Indicators of Compromise to the assisted public administrations through the IoC Flow channel.

Follow us on Telegram for more pills like this

03/06/2024 19:59

Editorial AI

Last pills

Cyber attack on TeamViewer: immediate response and investigations underwayStrengthened security measures and international collaborations to counter the cyber threat

Polyfill JS supply chain attack: what happenedA detailed analysis of the cyber attack that compromised a library essential for JavaScript compatibility in browsers

Security alert: supposed LockBit intrusion into the Federal Reserve systemPossible consequences and responses of the authorities to the alleged cyber breach of the Federal Reserve

Serious digital security incident in Indonesia puts sensitive national data at riskRecent vulnerabilities and the national response to cyberattacks