Story image

A new twist on an old phish: Apple scams now using encryption

15 May 2018

Persistent phishing scams targeted at Apple users continue to plague inboxes – but what’s happening behind the scenes? Trend Micro recently deconstructed a new phishing scam that targets Apple IDs and uses AES encryption as part of its processes.

One of the latest Apple phishing scams, spotted on April 30, uses social engineering to trick users into thinking their Apple account is suspended.

The phishing attacks are also occurring at a time when many genuine businesses are sending emails that ask users to update their details or strengthen security, as part of GDPR requirements.

“It comes as no surprise that malicious actors are trying to take advantage of this email wave by sending phishing pages to users. These actors are getting quite good at impersonating major companies, and they usually try to masquerade as legitimate ‘user policy update’ emails,” Trend Micro says.

The firm says Apple IDs and passwords are valuable to cybercriminals because they can provide access to all applications linked to that Apple account.

This particular scam looked like a genuine email from Apple, however it was flagged for numerous reasons. It was sent to a recipient who did not use Apple products; it asked the person to update their payment details due to ‘suspicious activity’, and the ‘Update Your Payment Details’ link did not point to the official Apple domain name.

Instead, the link pointed to a website that generated a new token for each victim.

“The token was valid for at least 48 hours. It seemed to be for tracking the user and was not affected by various user-agents of the different browsers and devices. If clicked, the button opened to a fake Apple website stylised to look legitimate—the fake site even had the same background image as the legitimate Apple site. But the URL was obviously not Apple,” Trend Micro says.

What made this phishing attempt different than others is that the phishing site was encrypted using AES.

“Using AES for this kind of obfuscation is unusual for a phishing scam because usually these malicious actors are more concerned with operations rather than security or evasion,” Trend Micro says.

When the security firm logged in using a fake Apple ID, it was directed to a malicious website designed to collect data including names, dates of birth, phone numbers, addresses, and credit card details.

After the site had collected all information, it told victims they would be logged out for security reasons. They were then forwarded to the genuine Apple website.

In this case the cybercriminals put effort into securing the information they collected, and even the web directory permissions were correctly set so security researchers weren’t able to access the stolen data.

“Users should be wary of links sent by email to access pages like Apple ID login, Google login page, PayPal, social networks and other sensitive sites. There might be other malicious links or file attachments as well, so scanning attachment files with security solutions is a must. Also, users should try to verify the urgency of the information found in suspicious emails from other sources, like the social media pages of the particular organisation,” Trend Micro concludes.

Secureworks Magic Quadrant Leader for Security Services
This is the 11th time Secureworks has been positioned as a Leader in the Gartner Magic Quadrant for Managed Security Services, Worldwide.
Google puts Huawei on the Android naughty list
Google has apparently suspended Huawei’s licence to use the full Android platform, according to media reports.
Using data science to improve threat prevention
With a large amount of good quality data and strong algorithms, companies can develop highly effective protective measures.
General staff don’t get tech jargon - expert says time to ditch it
There's a serious gap between IT pros and general staff, and this expert says it's on the people in IT to bridge it.
ZombieLoad: Another batch of flaws affect Intel chips
“This flaw can be weaponised in highly targeted attacks that would normally require system-wide privileges or a complete subversion of the operating system."
Forget endpoints—it’s time to secure people instead
Security used to be much simpler: employees would log in to their PC at the beginning of the working day and log off at the end. That PC wasn’t going anywhere, as it was way too heavy to lug around.
DimData: Fear finally setting in amongst vulnerable orgs
New data ranking the ‘cybermaturity’ of organisations reveals the most commonly targeted sectors are also the most prepared to deal with the ever-evolving threat landscape.
IXUP goes "post-quantum" with security tech upgrade
The secure analytics company has also partnered with Deloitte as a reseller, and launched a SaaS offering on Microsoft Azure.