Story image

A new twist on an old phish: Apple scams now using encryption

15 May 18

Persistent phishing scams targeted at Apple users continue to plague inboxes – but what’s happening behind the scenes? Trend Micro recently deconstructed a new phishing scam that targets Apple IDs and uses AES encryption as part of its processes.

One of the latest Apple phishing scams, spotted on April 30, uses social engineering to trick users into thinking their Apple account is suspended.

The phishing attacks are also occurring at a time when many genuine businesses are sending emails that ask users to update their details or strengthen security, as part of GDPR requirements.

“It comes as no surprise that malicious actors are trying to take advantage of this email wave by sending phishing pages to users. These actors are getting quite good at impersonating major companies, and they usually try to masquerade as legitimate ‘user policy update’ emails,” Trend Micro says.

The firm says Apple IDs and passwords are valuable to cybercriminals because they can provide access to all applications linked to that Apple account.

This particular scam looked like a genuine email from Apple, however it was flagged for numerous reasons. It was sent to a recipient who did not use Apple products; it asked the person to update their payment details due to ‘suspicious activity’, and the ‘Update Your Payment Details’ link did not point to the official Apple domain name.

Instead, the link pointed to a website that generated a new token for each victim.

“The token was valid for at least 48 hours. It seemed to be for tracking the user and was not affected by various user-agents of the different browsers and devices. If clicked, the button opened to a fake Apple website stylised to look legitimate—the fake site even had the same background image as the legitimate Apple site. But the URL was obviously not Apple,” Trend Micro says.

What made this phishing attempt different than others is that the phishing site was encrypted using AES.

“Using AES for this kind of obfuscation is unusual for a phishing scam because usually these malicious actors are more concerned with operations rather than security or evasion,” Trend Micro says.

When the security firm logged in using a fake Apple ID, it was directed to a malicious website designed to collect data including names, dates of birth, phone numbers, addresses, and credit card details.

After the site had collected all information, it told victims they would be logged out for security reasons. They were then forwarded to the genuine Apple website.

In this case the cybercriminals put effort into securing the information they collected, and even the web directory permissions were correctly set so security researchers weren’t able to access the stolen data.

“Users should be wary of links sent by email to access pages like Apple ID login, Google login page, PayPal, social networks and other sensitive sites. There might be other malicious links or file attachments as well, so scanning attachment files with security solutions is a must. Also, users should try to verify the urgency of the information found in suspicious emails from other sources, like the social media pages of the particular organisation,” Trend Micro concludes.

NZ Internet Task Force joins iSANZ Hall of Fame
NZITF chair Barry Brailey and former chairs Mike Seddon and Paul McKitrick received the award in Auckland last week.
Quantum computing: The double-edged sword for cybersecurity
Quantum computing is quickly moving from science fiction to reality.
Three ways to achieve data security whilst enabling BYOD
"A mobility strategy is now more important than ever before, that said, selecting the right one is often no small task."
How IoT and hybrid cloud will change in 2019
"Traditional VPN software solutions are obsolete for the new IT reality of hybrid and multi-cloud."
WatchGuard’s eight (terrifying) 2019 security predictions
The next evolution of ransomware, escalating nation-state attacks, biometric hacking, Wi-Fi protocol security, and Die Hard fiction becomes reality.
GCSB's CORTEX project scoops iSANZ Award
“I believe this award is particularly significant as it is acknowledgement from our peers in the information security industry and from across the private sector."
NZ firms lack cybersecurity confidence, HP survey says
Out of 434 of New Zealand’s small and large businesses, only half (50%) feel confident that they would be able to cope if they experienced a significant cybersecurity breach.
SonicWall secures hybrid clouds by simplifying firewall deployment
Once new products are brought online in remote locations, administrators can manage local and distributed networks.