Scammers are continuing to abuse the QuickBooks tax accounting software to send phishing scams, according to Roger Kay at INKY.
“All versions of QuickBooks have the ability to send invoices, and in this case, the bad guys turned this capability into an attack vector for a low-tech phone scam,” Kay writes. “In the past year, phone scams have been on the rise as phishers respond to the increasing sophistication of anti-phishing defenses: defenders go high, phishers go low. A simple mechanism is a phone number that the phishers want the mark to call. When they do, an operative will try to extract valuable information from them.”
The messages are impersonating Amazon, Apple, Best Buy, PayPal, Norton, and McAfee. Users are instructed to call a phone number to cancel a purchase they didn’t make.
“INKY began to see instances of this particular attack in December 2021,” Kay says. “They accelerated significantly in March 2022. Although we have detected 2,272 to date, that number is surely an undercount. The exact count is difficult to determine since the subtle scam emails and legitimate QuickBook notifications all originate from the real QuickBooks notification site: quickbooks@notification.intuit[.]com.”
Since QuickBooks is a legitimate software product, the phishing messages were able to bypass security filters.
“These attacks were highly effective at evading detection because they were identical to non-fraudulent QuickBooks notifications, even when examining the emails’ raw HTML files closely,” Kay says. “All notifications originated from authentic Intuit IP addresses, passed email authentication (SPF and DKIM) tests for intuit[.]com, and only contained high-reputation intuit[.]com URLs.”
Kay concludes that users should pause and think before reacting to messages that instill a sense of urgency.
“The effectiveness of these techniques relies on the panic a victim might feel if they received an invoice for goods or services that they did not purchase,” Kay writes. “The emotional reaction to notification of this sort can be strong and may impair judgment. The natural response is to get right on the phone and try to back the order out, or, barring that, find a way to obtain a refund. The phishers take advantage of this disrupted emotional state to extract personal or financial information before the victim realizes that something is off.”
New-school security awareness training can enable your employees to thwart phishing attacks by teaching them how to recognize social engineering tactics.
INKY has the story.
Here's how it works:
