It’s being reported that hackers have been using credit card stealing malware to infect popular retailers such as Zara just as the Christmas shopping craze begins. Cybersecurity firms have confirmed that hackers have recently been using the notorious Zeus Panda Trojan to target UK-based shoppers getting ready for the festive season. Once hackers inject the Zeus Panda Trojan or any of its variants into its target, the hackers can steal a retailer’s customer credit card information. IT security experts are commented below.
Tim Helming, Director of Product Managementat DomainTools:
“As with so many scams, this one typically originates with a phishing lure. The attackers–who, according to DomainTools data, have set up large numbers of scam domains–set up URLs that look legitimate at a glance. People who visit these URLs or who open malicious attachments in phishing emails silently download a piece of malware that then steals financial information such as credit card numbers and bank login credentials. This serves as a reminder that shoppers need to be ever-vigilant against phishing emails; this time of year, many of those emails imitate shipping delivery notices and other seasonal content. However, it’s also worth remembering that phishing is a year-round problem.”
“This scam is yet another example which illustrates the increasing popularity of spoofing and impersonation techniques in phishing campaigns. By utilising these techniques, fraudsters make it difficult for end users to spot what, and who, is the real deal- and who is not. When these techniques are executed well, cybercriminals can get their hands on individuals’ personal details, and use them to exploit them in a variety of nefarious ways; this is, of course, not confined to personal information- if a scam such as this falls into the inbox of an employee, then an entire organisation could be put at risk.
It is important never to click the link provided in emails, and definitely do not give up your personal or financial details- if you are even the slightest bit unsure, contact the apparent sender over the phone, and ask for advice. Legitimate companies or Government bodies, like HMRC, will never ask for details such as this- being vigilant could save you from becoming a victim.
In addition to this, businesses must work to prevent and help their users spot and correctly act upon emails such as these, before they unfold into a large scale cybersecurity incident, which could compromise the entire organisation. To spot the anomalies common in spoofing and impersonation techniques, user behaviour analysis and mailbox level detection, and utilising context based mail alerts, which, by allowing quick reporting via an augmented email experience, will help users make smarter decisions.”
ISBuzz Team embodies the collaborative efforts of the dedicated staff at Information Security Buzz, converging a wide range of skills and viewpoints to present a unified, engaging voice in the information security realm. This entity isn't tied to a single individual; instead, it's a dynamic embodiment of a team diligently working behind the scenes to keep you updated and secure. When you read a post from ISBuzz Team, you're receiving the most relevant and actionable insights, curated and crafted by professionals tuned in to the pulse of the cybersecurity world. ISBuzz Team - your reliable compass in the fast-evolving landscape of information security
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.