This particular phishing scheme uncovered by Abnormal Security weaponizes many people’s fear of losing their job due to the economic downturn during the coronavirus pandemic. To date, more than 26 million people in the U.S. for unemployment since the pandemic began.
These spoofed emails come in the form of a Zoom meeting reminder with HR concerning the termination of the recipient’s employment.
The email contains a Zoom meeting invitation link, which is actually the hacker’s phishing site designed to mimic the look of Zoom’s login page. In reality, clicking the meeting link forwards the target to a page hosted at the URL “zoom-emergency.myftp.org.”
“When the victim reads the email they will panic, click on the phishing link, and hurriedly attempt to log into this fake meeting,” explains Abnormal Security’s report. “Instead, their credentials will be stolen by the attacker.”
Email security researchers say this attack has successfully found its way into more than 50,000 mailboxes.
Zoom has experienced tremendous growth since the beginning of the global coronavirus pandemic. With several countries instituting lockdowns, quarantines, and stay-at-home orders, many businesses have transitioned their employees to work-from-home arrangements.
A earlier this month found that more than 500,000 stolen Zoom accounts were being bought and on the dark web. Hackers frequently gain access to these accounts through spoofed emails and phishing pages like the one described in this latest security report.
Readers should always be careful when clicking links in an email that require login credentials. Always double-check the sender’s email address and the attached link.
And if you’re still not sure, take this extra cautionary step: If you receive an email link purporting to be from Zoom or any other website for that matter, don’t click! Just type out the official URL for that website in the web browser yourself.