Cybercrooks target students with fake job opportunities
- Reference: 1648550708
- News link: https://www.theregister.co.uk/2022/03/29/student_scams/
- Source link:
From the department of "if it's too good to be true, it probably is" comes a study in which Proofpoint staffers responded to enticement emails to see what would happen.
This particular threat comes in the wake of COVID-19, with people open to working from home and so perhaps more susceptible. "Threat actors use the promise of easy money working from home to collect personal data, steal money, or convince victims to unwillingly participate in illegal activities, such as money laundering," the researchers said.
[1]
"The threat, called employment fraud, almost exclusively impacts higher education."
[2]
[3]
Employment fraud has many forms, where victims are presented with what looks like a legitimate offer and end up handing over all manner of confidential information. Researchers found potential roles including mystery shoppers, caregivers, personal assistants, and so on. In some instances, victims ended up unwittingly committing crimes.
There was also evidence of Advanced Fee Fraud (AFF), where an attacker seeks to extract a relatively small amount of cash from the victim in exchange for the promise of a big payout later.
[4]
Researchers found that the threats disproportionately affected students at colleges and universities (although staff at the institutions were also targeted). The majority of targets were based in the US, although European and Australian institutions did not evade the attention of miscreants.
Why universities? Proofpoint pointed to students being more open to remote opportunities and international students not being as quick to spot some of the telltale signs of a fraudulent email as a native English speaker. Rising costs are also making the lure of easy money all the more tempting.
[5]IcedID malware, in the hijacked email thread, with the insecure Exchange servers
[6]Sophos fixes critical hijack flaw in firewall offering
[7]Google Chrome, Microsoft Edge patched in race against exploitation
[8]China APT group using Russia invasion, COVID-19 in phishing attacks
The researchers took one for the team and responded to a pair of emails to see what would happen. One that purported be from UNICEF for an Executive Personal Assistant and another for a modeling assignment.
In both cases, the interactions were impressively sophisticated.
For the UNICEF scam, victims were sent to a Google Form where personal data was collected. A scammer then contacted the victim, asking for more information and giving details on the fake position itself, including "buying and distributing toys for 'orphanage homes.'"
[9]
The researcher was sent a fake cashier's check for $950 followed by a bigger fraudulent check for $1,950. They were then asked (after a balance check) to send $1,000 to one of the supported "orphanages" with a Bitcoin address used for follow-up payments. The fake checks meant the victim would be sending their own money, Proofpoint said.
While UNICEF is aware of scams in its name and has put out an [10]advisory on the matter, miscreants have a variety of weapons in their armory, as evidenced by the modeling assignment to which a Proofpoint researcher responded.
This time a threat actor pretended to be from an agency seeking models for a Los Angeles shoot. A fake check for $4,950 was emailed as a fee, and $100 in cryptocurrency was requested in order to cover the "shipping" of items needed for the photoshoot.
While dodging scams seems straightforward (employers don't usually send out checks before the first day of work and legitimate organisations rarely make use of freebie email accounts to send out unsolicited offers), the victims being targeted might be blinded by the fake opportunity. ®
Get our [11]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YkMtMsvhrCF-J7nx-h9PnQAAAEc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YkMtMsvhrCF-J7nx-h9PnQAAAEc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YkMtMsvhrCF-J7nx-h9PnQAAAEc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YkMtMsvhrCF-J7nx-h9PnQAAAEc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2022/03/29/icedid_microsoft_exchange_phishing/
[6] https://www.theregister.com/2022/03/28/sophos-firewall-rce-vulnerability/
[7] https://www.theregister.com/2022/03/28/google_chromium_exploit/
[8] https://www.theregister.com/2022/03/28/mustang-panda-korplug-variant/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YkMtMsvhrCF-J7nx-h9PnQAAAEc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://www.unicef.org/careers/beware-fraudulent-job-offers
[11] https://whitepapers.theregister.com/
Re: Do an online job interview, we'll pay you for the privilege
Phishing is standard these days, it's made so realistic because so many companies no longer handle their own emails, they are all using third party servers to send email, publish their web pages, and log into accounts. Very little of the internet is designed to be safe these days, it's just supposed to be easy to use - the cybercrooks appreciate that.
Re: Do an online job interview, we'll pay you for the privilege
" Very little of the internet is designed to be safe these days "
A lot of it is actively becoming less safe. Notable examples are the growing use of "URL shortening", the prevalence of random-looking character strings (hashes maybe) as the path component of URLs and the Outlook "safelinks" system that wraps URLs in emails in an 'outlook' wrapper and obfuscates the path component. All of them prevent the user identifying what they're about to be served as a result of the click.
The most important security tools are attentiveness and common sense, but they're entirely thwarted by these tricks.
Web security tools...
... I'd add to not have any financial apps installed, or log in to any financial services, on a phone.
We'll buy your work PC
Another scam -- "Congratulations on your new job with us. Here is a cheque, go to this (online) store and buy your work laptop."
The cheque is a fake; so is the store, and so the victim paid their own money to the "store".
And no laptop was delivered.
Got this one, some years ago
"This time a threat actor pretended to be from an agency seeking models for a Los Angeles shoot. A fake check for $4,950 was emailed as a fee, and $100 in cryptocurrency was requested in order to cover the "shipping" of items needed for the photoshoot."
My daughter got this one, some years ago. Tempting, indeed, but can't say if the check was legit and the 100 bucks were to be paid immediately.
A case of race condition, the time it takes you to realize the check is fake, the 100 bucks are gone ...
Educational level without brains
These are university students that are targeted. If they fall for this crap, then you gotta scratch your head a bit... These are people supposed to be more clever than the average, are they not? Maybe computers do dumb us down too much. Then we deserve what we get.
Re: Educational level without brains
Wishful thinking causes many a lapse in judgement though.
Re: Educational level without brains
Being educated in an academic subject doesn't mean you've been taught to survive on the street. Or on the Internet.
Different skills, different approaches. Highly intelligent people do fall for scams, and often haven't encountered the mindsets and learn the suspicions that help avoid them.
Do an online job interview, we'll pay you for the privilege
I've recently received several phishing emails for job interviews with presence fees being offered (against filling a webform with my PPI). As I received them on my work mail address, I alerted corporate that phishing emails were finding their way through to our mailboxes. Their only response was "yes, that's a phishing email, you should delete it"