Bogus Amazon account compromise notice leads to phishing
Posted on 29 November 2012.
A phishing email impersonating Amazon is hitting users' inboxes, trying to trick them into believing that various computers connected to their Amazon account and threatening account suspension unless they "confirm" their account information (click on the screenshot to enlarge it):



In spite of the atrocious spelling and grammar mistakes in the email, the link takes victims to a high-quality spoof of the Amazon.co.uk login page that asks users to submit their email address, Amazon account password, then redirects them to a spoofed Amazon.com page asking for their name, address, date of birth and credit card information.

Avira's Sorin Mustaca points out a few interesting details about this phishing attempt: the jumping from one to the other Amazon domains, the fact that some of the spoofed pages' source code was lifted from the legitimate ones, and that the spoofed page actually returns an error if the victim enters an email address that is too long.

Despite the aforementioned jumping, it's highly likely that most users who follow the link won't notice the difference. If they believed that poorly written email came from Amazon, they are probably not the most perceptive of users.






Spotlight

5 ways to stop the Internet of Things from becoming the Internet of Thieves

Attacks on the IoT can sound like the stuff of a movie thriller, but they are very real. The highly skilled and organized cybercriminals of today have the potential to tamper with a car’s firmware to kill its brakes.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Tue, Jun 30th
    COPYRIGHT 1998-2015 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //