Instagram Phishing: Scammers Exploit Instagram Verification Program
Researchers at Vade warn that an email phishing campaign is informing users that their Instagram account is eligible to receive a blue verification badge. If a user clicks the link, they’ll be taken to a spoofed Instagram login page designed to steal their credentials.
“First discovered by Vade in late July, the scam exploits Instagram’s highly sought-after verification program to dupe victims into divulging personal information and account credentials,” the researchers write. “The malicious attack targets specific users of the social media platform, showing more sophistication than other phishing campaigns that pursue victims indiscriminately.”
The emails impersonate Instagram, and are tailored to each target. The phishing page URL is “teamcorrectionbadges[.]com.”
“The phishing email uses the subject line, ‘ig bluebadge info’ and the name, ‘ig-badges,’” the researchers write. “The body text explains that the victim’s Instagram profile has been reviewed and deemed eligible for verification. The Instagram and Facebook logos at the header and footer of the email attempt to create an air of legitimacy, as does the use of the victim’s actual Instagram handle, showing the hackers researched their target before the attack.”
The researchers note that observant users could recognize some discrepancies and signs of social engineering in the email.
“Other signs suggest a classic case of phishing,” the researchers write. “Grammatical errors and typos appear several times in the text—the common calling card of foreign bad actors—including the phrase, ‘Thanks, you instagram team.’ The email also urges prompt action—another hallmark of phishing and spear phishing emails—telling the victim, ‘if you ignore this message, the form will be permanently deleted within 48 hours.’”
Vade adds that Instagram requires users to apply for badges, and typically only verifies high-profile users with large followings. New-school security awareness training can teach your employees to recognize the signs of social engineering attacks.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW