- Security researchers observe hackers engaging in pork butcher scams
- They impersonate legitimate businesses through Zendesk’s services
- The researchers said that Zendesk’s control system is not thorough enough
Cybersecurity researchers, CloudSEK, have found that criminals are misusing Zendesk to run impersonation scams, where hackers abuse simple program features to engage in pork butcher scams to cheat people out of their money.
Zendesk allows users to register free trial accounts, which in turn allow the creation of subdomains, which unfortunately allows criminals to abuse it on a large scale.
First, they would create a fake subdomain impersonating a legitimate company, which would be used to send phishing emails pretending to be actual customer support communications. Since Zendesk is a legitimate company, emails often bypass spam filters and land, disguised with accurate branding, directly in people’s inboxes. The emails apparently contain an image hyperlinked to a phishing page where the scam continues.
Pig slaughter
The goal of the scam is to get people to invest in a fake investment platform or support site – a staple of pork butcher scams. The list is designed to last as long as possible and drain money from the victim until they realize they have been scammed.
The problem, according to CloudSEK, is that Zendesk does not perform thorough email validation when adding users to subdomains. “This monitoring allows attackers to target employees or customers with phishing attempts masquerading as legitimate ticket assignments,” the researchers said.
Zendesk has been informed of the flaw and its potential for abuse in accordance with CloudSEK’s responsible disclosure policy, CloudSEK concluded.
We have contacted the company and will update the article if we hear back.
