Urgent phishing warning issued to anybody who uses Gmail or Microsoft Outlook

19 March 2023 , 01:44

693     0

Email users have been warned to look out for dynamic phishing scams (Image: AFP via Getty Images)

An urgent warning has been issued to millions of Gmail and Outlook email users over an increase in phishing scams.

Cyber defence company BlueVoyant said it had seen a 240% rise in email scams, with some of them hard to spot.

The security experts warned that fraudsters were using a technique called dynamic phishing in a bid to steal people's personal information and financial details.

Dynamic phishing attempts to dodge criminals being rumbled by sending threat hunters to an error page, while consumers find themselves landing on a spoof domain page.

Users should be wary of unexpected emails, such as invoices from well-known online companies, and if in doubt look up the company URL online themselves rather than following a link.

'Most impersonated woman' used by scammers to steal from thousands of men

Mobile users are also being targeted with a technique known as smishing (SOPA Images/LightRocket via Getty Images)

Birmingham Live reported BlueVoyant as explaining: "One of the more complicated ways threat actors evade detection involves multiple redirect paths, steering consumers to spoofed domains while redirecting presumed threat hunters or phishing analysts to an error page.

"These evasion mechanisms include User Agent or IP restrictions and blocklisting, with significant emphasis placed on bot and crawler detection.

“The purpose of this type of redirection is to hide the phishing content on a single website by diverting threat hunters elsewhere, i.e. the target's official domain, a google search, etc.

“Dynamic DNS hosting providers are particularly popular among threat actors because they provide a convenient platform to easily set up and host multiple phishing pages without having to register a domain.

BlueVoyant warned that the email scams can be hard to spot (SOPA Images/LightRocket via Getty Images)

“BlueVoyant has been tracking phishing activity leveraging this infrastructure since 2021, and found that 67% of all phishing attacks were hosted on dynamic DNS infrastructure by the end of that year, demonstrating the infrastructure’s quick adoption and massive scale of use.”

The security analysis also found a steady increase in SMS phishing -known as smishing - which targets mobile phone users with bogus text messages.

"To carry out a successful smishing attack, threat actors require an automated tool that can send SMS messages in bulk,” the report says.

“SMS gateway scripts are sold on the deep and dark web as all-inclusive solutions, which are rather easy to operate, and require very little technical knowledge.”

James Rodger