Credit: Dreamstime
Cyber criminals are taking advantage of the Christmas season by making postal presents and party invites their latest target of attack.
One hack circulating currently is a text message scam that takes advantage of people expecting parcels from Australia Post.
Revealed by the Australian Cyber Security Centre, the messages use the branding of Australia’s postal service to send consumers fake SMS messages that say a parcel is ‘detained’, ‘you’ve missed a delivery’ or there’s an ‘important update’ to your delivery’.
These messages all include a link to click on for more details, which takes unsuspecting clickers to a fake Australia Post website where they are asked to enter your personal or financial details.
Clicking on these links can also infect your device with malware, explained the ACSC, and can be deceiving as scammers use technology that imitates a caller ID, making the messages appear in the same conversation thread as a legitimate Australia Post conversation.
According to ACSC, consumers can detect whether the texts are legitiamate by typing in Australia Post’s official website and compare it to the one in the text without clicking on it.
“Look out for an unusual sense of urgency, including demands for payment,” the cyber agency said in an alert post. “Think before you click and never provide your personal or financial details by reply SMS or email. Australia Post will never SMS customers asking for personal or financial information, or a payment.”
Meanwhile, also attempting to capitalise on the festive mood are scammers using email invites to invite people to fake end-of-year events or parties.
First detected on 10 December, the email is infiltrating inboxes using the subject ‘Invitation to our end of year event’ and contains the Adobe Document Cloud in the body.
The email then informs recipients that the sender has “sent you a download link for “Invitations.pdf”, which ends with a thank you note supposedly from ‘The AdobeCloud team’.
According to Mailgaurd, which intercepted the scam, recipients who click on the link to ‘Open’ the invite are then led to a fake Droplr-branded page containing the file sharing platform’s logo.
This then informs users that to view the invite, they need to ‘access OneDrive’, which then leads users to another page, this time using fake ‘OneDrive’ branding, where users are told log in to their email accounts to ‘to read the document’.
According to MailGuard, this is a phishing site designed to harvest users’ username and password, advising users to delete the immediately without any links.
“Festive periods such as Christmas and New Year are a common time for cyber criminals to hit inboxes with email scams,” MailGuard said in a blog post. “They exploit distracted professionals who are in a rush to finish pending tasks before going on their holiday break.
“Because of the festive season, it’s not uncommon to receive an e-invitation to the end-of-year festivities such as this in your inbox. Cybercriminals behind this scam are banking on the timely nature of this email to trick users, who might actually be expecting such invitations this time of the year.”
Red flags to spot with such scams include emails not using a user’s name, poor English or omit details such as tracking ID.
In addition, users should be vigilant if it’s a business they’re not expecting to hear from, asks to click on any suspicious links and has a link landing page or website that does not have the legitimate URL of the company the email is purporting to be sent from.
