- Hackers launch BEC scams using HR bonus themed emails with QR codes
- Victims redirected to fake login pages via mobile devices for credential theft
- The campaign showcases advanced evasion tactics that take advantage of seasonality and major global events
Be careful when receiving e-mails from your company about year-end bonuses – they may be a scam.
With companies now considering bonus awards, performance reviews and benefits enrollment processes, hackers are taking advantage of trying to steal people’s workplace passwords and login information.
Security researchers Mimecast have warned emails with subject lines like “Let’s end the year right – fill out your bonus form!” is already making the rounds. These are Business Email Compromise (BEC) campaigns, as the emails originate from compromised email accounts belonging to the victim organization’s Human Resources (HR) departments.
Moving the victim to mobile
Emails are sent to other employees in the same organization and carry the official branding and logos.
Attached to the messages are PDF files with a QR code that the victim must scan with their mobile device. Apparently, the first goal of the campaign is to move the victim from the PC to the mobile environment, as security there is not as robust as it is on a desktop platform.
When the victim pulls up their mobile device and scans the QR code, they are redirected through several websites, ultimately landing on a page where they have to log in to their business accounts.
“This campaign demonstrates operational maturity through its use of geographically distributed compromised accounts, mobile device filtering and CAPTCHA bypass techniques to avoid detection,” Mimecast explained.
Cybercriminals regularly use events and important dates in their campaigns to increase their perceived legitimacy and thus steal more credentials. Tax season, the holiday season, Black Friday and of course – the year-end performance reviews are among them.
They also take advantage of major events, such as the FIFA World Cup, the Olympic Games or the US presidential election.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds. Be sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, video unboxings, and get regular updates from us on WhatsApp also.
