Gift cards new vector in CEO fraud
January 29 saw the arrival of yet another interesting variant of the gift card phishing campaigns that have become more common this year (see below). Today's email demonstrates that bad guys are actively adapting and evolving their pitch into CEO fraud.
There are couple interesting things going in this new gift card phish:
The bad guys work to establish a credible pretext ("incentives" for staff) -- something they've been getting better at recently.
They explicitly request confidentiality -- another tactic we've been seeing more of recently.
They're getting really greedy -- $4000 total in gift cards, the largest request we've yet seen (most requests in these gift card phishing schemes range from $500-$2000).
But there's something else very significant going on here, ... Read More
Conversation with a Mac and security expert RE: malware
We need to have a conversation about Macs, says TJ Letourneau of VIPRE Security. I’ve been a long-time fan of Mac. In fact, my first personal Mac was a Power Mac G5 and I absolutely loved that device. So much so that when I had to evacuate my home due to a hurricane…I brought it with me! Yeah, it was like that. Some call it the greatest love story ever told.
With my love of the Mac in mind, I feel that the time has come to discuss the state of Macs today and some of the preconceived notions around their security and security needs. Specifically, I want to discuss malware-related security, for Mac devices.
“Macs are Completely Safe, ... Read More
Spear phishing popular avenue for DNS hijacking
On Jan. 22, 2019, the Cybersecurity and Infrastructure Security Agency (CISA), which is a part of the U.S. Department of Homeland Security (DHS), issued Emergency Directive 19-01. The title of the directive is: Mitigate DNS Infrastructure Tampering. A series of actions are required for federal agencies. Watch how targeted spear phishing has become. Here is the background:
“In coordination with government and industry partners, the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) is tracking a series of incidents involving Domain Name System (DNS) infrastructure tampering. CISA is aware of multiple executive branch agency domains that were impacted by the tampering campaign and has notified the agencies that maintain them.
Using the following techniques, attackers have redirected and intercepted ... Read More