Phishing Lessons

A newer Phishing Fraud campaign is out targeting Bank of America customers.

The email arrives:

Subject:     Bank Of America Alert : Your Account Has Been Locked
From:     Bank Of America Alert <e-banking@bofa.com>

Naturally the sending address is spoofed, as these emails arrive from hijacked mail servers in Europe and Asia.

What’s notable is the general quality of the Phishing email:

Click for Larger Image

(more…)

Another twist on the very active campaigns designed to trick users into providing their email account logins and passwords arrives with the warning:

Subject:      Your mailbox has exceeded the storage limit

The sending addresses are randomly generated, typically coming from hijacked web site mail servers, but the content of these Phishing fraud emails are pretty simple:

Your mailbox has exceeded the storage limit which is 20GB as set by your administrator, you are currently running on 20.9GB,To re-validate your mailbox Clickhere:  or copy this(http://bit.ly/a8zCsk ) and past in your browser to increase your mailbox size or you loose your account within 24 hours. System Administrator Center.

(more…)

Dear Customer:

Your Secure login details seem to have been compromised.

Any email that starts out in this vein should cause you to be extremely suspicious. As a case in point, the opening above comes from a TD Canada Trust Phishing fraud attempt that we recently intercepted.

The message itself looks like this:

Subject: TD Internet Banking Security

From: TD Canada Trust <security@easyweb.com>

To: [redacted]

Dear Customer:

Your Secure login details seem to have been compromised.

Please log in to the secure link below, and verify your security

details to avoid an unecessary suspension of your account.

We may call you to verify any information, and such calls may include
computer-generated speech

To log in and verify your account click on the Security link:

EasyWeb-SECURITY

Thank you.
Customer Service
TD Group Financial Services.

A few notes about the message before we get to the good part:

1. The spoofed “From:” address  is “TD Canada Trust <security@easyweb.com>”. However, none of the message headers indicate that it was ever anywhere near a server associated with “easyweb.com”.
2. The “TD Canada Trust – EasyWeb” logo is the real logo from tdcanadatrust.com displayed through the magic of HTML.
3. The “EasyWeb-SECURITY” link above actually goes to the bogus web site so don’t click it unless you have good, up to date anti-virus software. (6/15/2010 – Update: link removed)
   

All of this is pretty normal for a fraudulent email Phishing campaign.

What’s outstanding about this one is the quality of the login page it links to.

(more…)