A phishing campaign is impersonating the Canada Revenue Agency (CRA) in an attempt to steal Canadians’ personal information, according to Rene Holt at ESET. The phishing emails inform users that they’ve received a tax refund of just under CAD$500. The user is directed to click on a link to a spoofed Government of Canada site.
“Understanding how phishers abuse links in emails, the CRA has taken the wise strategy of not providing links in official correspondence and instead instructing clients to navigate on their own to the official website,” Holt writes. “If, however, you do click on the ‘Interac e-Transfer Autodeposit’ button, you are redirected from a malicious link hosted on istandyjeno[.]hu to the malicious subfolder cra_ca_service hosted on oraclehomes[.]com.”
While the phishing page is a convincing replica, users could recognize the site as a scam if they tried to visit other pages.
“Clicking on ‘Jobs’ simply populates the URL with the value of the id attribute of the HTML element for ‘Jobs,’” Holt says. “Next, if you click on the ‘Proceed’ button on the opening page, the next page asks for your personal information, including your social insurance number, date of birth, and mother’s maiden name – indeed, everything a phisher would need for identity theft.”
Hoult offers the following recommendations for users to avoid falling for these scams:
- “Consider whether the purported sender normally communicates via email in this way.
- “Rather than clicking on links in an email, it is better to navigate manually to the official website of the apparent sender.
- “Check for obvious mistakes in the email. For example, why would the Canada Revenue Agency send you email from guidovedebe@skynet.be?
- “Always be wary of sharing your personal and financial information with any webpage.
- “Familiarize yourself with the CRA scam alerts page, especially with the samples of fraudulent emails impersonating the CRA.”
New-school security awareness training can give your employees a healthy sense of suspicion so they can recognize these types of social engineering attacks.
ESET has the story.
Here's how it works:
