Cybersecurity Expert On Cisco Webex Phishing Uses Fake Cert Errors To Steal Credentials

In response to reports of new phishing attacks using fake certificate error warnings with graphics and formatting lifted from Cisco Webex emails to steal users’ account credential, a cybersecurity expert offers perspective.

Experts Comments

May 08, 2020
Robert Ramsden Board
VP EMEA
Securonix
Our research has seen a rise in convincing phishing attacks targeting people working from home. Cybercriminals are increasingly using typo-squat variants of domains relating to COVID-19 as organisations have not been able to proactively monitor or block these harmful social engineering techniques for fear of not communicating vital and valid information about the pandemic. This challenge becomes even more complicated when considering cloned sites of trusted vendors such as Cisco Webex. We.....Read More
Our research has seen a rise in convincing phishing attacks targeting people working from home. Cybercriminals are increasingly using typo-squat variants of domains relating to COVID-19 as organisations have not been able to proactively monitor or block these harmful social engineering techniques for fear of not communicating vital and valid information about the pandemic. This challenge becomes even more complicated when considering cloned sites of trusted vendors such as Cisco Webex. We recommend that organisations enable use cases that track increased activity to newly registered domains or rare in order to identify early indicators of suspicious activity. This technique would help protect against this particular threat as the domain was recently registered in the Czech Republic. By flagging potentially malicious links from suspicious locations you can greatly reduce the chance of falling victim to social engineering techniques such as phishing. As more people work from home we will most likely see this become a sinister trend and security teams should stay a step ahead in order to reduce the impact of this activity.  Read Less
May 08, 2020
James McQuiggan
Security Awareness Advocate
KnowBe4
Criminal groups prey on their victims using urgent requests and fear to get their users to click on a link and entice them to log in on a fake website, all the while, stealing their credentials. This tactic is successful due to the reason that the target may not be aware of the nature of phishing links and to check the email address of the sender. A common rule of thumb is if an email is requesting the user to login and correct an issue, launch the website, and use a saved bookmark link or a.....Read More
Criminal groups prey on their victims using urgent requests and fear to get their users to click on a link and entice them to log in on a fake website, all the while, stealing their credentials. This tactic is successful due to the reason that the target may not be aware of the nature of phishing links and to check the email address of the sender. A common rule of thumb is if an email is requesting the user to login and correct an issue, launch the website, and use a saved bookmark link or a quick Google search for the product. Log in and verify if the information is accurate. Most of the time, it's not and just a way for the attacker to gain access to the victim's credentials. Organizations will want to have proper and timely security awareness and training for all employees. This way, they can spot and report any phishing attempts.  Read Less
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.
Be part of our growing Information Security Expert Community (1000+), please register here.

Share on facebook
Share on twitter
Share on linkedin

Recent Posts

Information Security Buzz (aka ISBuzz News) is an independent resource that provides the experts comments, analysis and opinion on the latest Information Security news and topics

Twitter Facebook-f Linkedin Youtube

Working With Us

The Pages

Our Contributing Experts