A new phishing scam has been discovered that is being used to steal the login credentials and phone numbers of employees. The new scam uses blurred images of invoices to lure victims into revealing sensitive information. In order to view the document or spreadsheet in higher resolution, the victim must supply their email address and password. It is not clear whether this blurred image phishing scam is being used for targeted attacks on businesses or whether the emails are being sent out randomly.
The Blurred Image Phishing Scam
A number of different versions of the same scam have been discovered by the Internet Storm Center, each of which uses a different document.
The initial email appears to have been sent from a legitimate company – a well-known company likely to be very familiar to most business users. HSBC for example. The emails contain corporate logos and are well written. They contain a link that must be clicked to view a purchase order or invoice.
Clicking the link will take the email recipient to a webpage where they are presented with what appears to be a legitimate document. The attackers use a screenshot of an excel spreadsheet (or word document) which appears blurred. The screenshot was taken on a low resolution yet is displayed in high resolution to ensure it cannot be read, although it is clear what the document is.
The login credentials are harvested and sent to the attacker along with the victim’s location and IP address. Users are subsequently directed to a fake Google authentication portal where they are asked to supply their phone number. If the victim enters their details and clicks to view the document, a PDF file will open.