New Bogus Invoice Emails Could Lead to Ransomware Attack

The people behind phishing emails appear to be getting more sophisticated. Reports from both sides of the Atlantic say such emails are including more personal details, something that was previously used only for high value target.

Phishing emails are a way to try to trick people into either providing confidential information such as bank details or online passwords, or by clicking on links that install malware, usually through security weaknesses in web browsers or office software. More and more phishing attacks now involve trying to install ransomware that locks up a computer until the victim pays the attackers.

Creating such an email involves a balance between resources and reward. At one extreme, some messages are intentionally unsophisticated and vague. They contain such little identifying detail that they only fool a tiny percentage of people, but are so easy to create that they can be sent to millions of targets.

At the other extreme, some messages are carefully crafted to include lots of personal detail and appear very convincing. It's too much hassle to send these to large groups of people, but they can be used for a specific target such as somebody whose computer is known to contain or connect to a source of valuable confidential data.

Bogus Invoices Part of Scam

Now it seems some phishers are managing to get the benefits of both approaches. British consumer affair radio show "You and Yours" says thousands of people have received emails that contain their full postal address, making them seem much more legitimate. (Source: bbc.co.uk)

The emails claim to be a demand for an unpaid invoice and request payment. The scam isn't designed to get the recipient to hand over any money, but rather to trick them into clicking a supposed link to a copy of the invoice, something they may do out of curiosity.

Execs Under Attack

Meanwhile in the US, security firm Proofpoint says personalized phishing emails are now going to thousands of people in senior management and executive roles: people who may have access to financial accounts or may have a high security clearance on their company's network. It notes such sophisticated attacks were once restricted to a few victims, usually as part of state-sponsored espionage. (Source: arstechnica.com)

In both cases, its unclear how the culprits are getting hold of the personal details. In the UK case, one theory is that they have breached a database of an online retailer. In the US case, the details may have been "scraped" from business network sites.

What's Your Opinion?

Have you noticed bogus emails getting more convincing? Have you ever come close to clicking on a link in an unsolicited email out of curiosity? What measures do you take to vet emails that seem suspicious?