New Phishing Campaign Impersonates Canada Revenue Agency
A phishing campaign is impersonating the Canada Revenue Agency (CRA) in an attempt to steal Canadians’ personal information, according to Rene Holt at ESET. The phishing emails inform users that they’ve received a tax refund of just under CAD$500. The user is directed to click on a link to a spoofed Government of Canada site.
“Understanding how phishers abuse links in emails, the CRA has taken the wise strategy of not providing links in official correspondence and instead instructing clients to navigate on their own to the official website,” Holt writes. “If, however, you do click on the ‘Interac e-Transfer Autodeposit’ button, you are redirected from a malicious link hosted on istandyjeno[.]hu to the malicious subfolder cra_ca_service hosted on oraclehomes[.]com.”
While the phishing page is a convincing replica, users could recognize the site as a scam if they tried to visit other pages.
“Clicking on ‘Jobs’ simply populates the URL with the value of the id attribute of the HTML element for ‘Jobs,’” Holt says. “Next, if you click on the ‘Proceed’ button on the opening page, the next page asks for your personal information, including your social insurance number, date of birth, and mother’s maiden name – indeed, everything a phisher would need for identity theft.”
Hoult offers the following recommendations for users to avoid falling for these scams:
- “Consider whether the purported sender normally communicates via email in this way.
- “Rather than clicking on links in an email, it is better to navigate manually to the official website of the apparent sender.
- “Check for obvious mistakes in the email. For example, why would the Canada Revenue Agency send you email from guidovedebe@skynet.be?
- “Always be wary of sharing your personal and financial information with any webpage.
- “Familiarize yourself with the CRA scam alerts page, especially with the samples of fraudulent emails impersonating the CRA.”
New-school security awareness training can give your employees a healthy sense of suspicion so they can recognize these types of social engineering attacks.
ESET has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW