This attack could give criminals control of your mobile or desktop browser
The goal of this is to obtain the passwords you use, which would allow attackers to access your banking and financial apps. The JavaScript-based redirect attacks are being delivered via Scalable Vector Graphics (SVG) files. These are treated mostly as harmless image files but they can be embedded with script elements design to redirect mobile and desktop browsers to dangerous websites. The destinations of the redirects are determined by the attackers.
Example of credentials phishing with the name of the company used by the attackers edited. | Image credit-Ontinue
According to Ontinue, the emails use weak or ineffectual email authentication domains. This allows the attackers to get potential victims to open the emails they send by pretending that they were sent by a trusted brands or an individual. The email includes "a call to action" which is an attempt to get the victim to open the image file or preview it on a mobile or desktop browser. Once the image is rendered, the SVG executes the embedded JavaScript silently. The JavaScript execution is achieved and the browser is then redirected without any user interaction.
-Ontinue
Watch out for emails that get downright pushy about having you view an image file immediately. If an email looks as though it was sent from a company you do business with, look for spelling errors or call the company using a phone number that you find online. You can't trust all business numbers you get from Google since some are crowd-sourced and are open to manipulation by bad actors.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Phone Arena
26-07-2025
- Phone Arena
FBI tells you how to protect yourself from this scam that "ends with you losing your savings"
The FBI has issued the latest in a series of serious warnings to smartphone users. In the past, the agency has warned smartphone owners about dangerous emails designed to get them to reveal the passwords they use to safeguard their financial apps and protect their banking, crypto, and securities accounts. Now, the FBI is telling connected consumers to worry once again about "The Phantom Hacker Scam," a well-designed scam created to wipe out many smartphone users. "It starts with an unsolicited message, and it ends with you losing your savings," the FBI says. The warning heats up as the FBI says, "The threat is growing fast." The scam starts with communication from the victim's bank via text or email telling them in an urgent manner that they need to call tech support for assistance. When they call the phone number listed in the message, they're told by an imposter pretending to work at the bank that their funds are at immediate risk from a hacker who broke into one of their devices. This is all bogus, of course. The hacker is as fake as the bank employee who tell the victim that he will help him over the phone go through the process of securing his device. To do this, the fake bank employee will pretend to transfer the victim to tech support, and another one of the scammers will pick up the phone to say that he is from the bank's tech support unit. He goes on to tell the victim that a special app needs to be installed on his phone so the bank can check out the level of security on the device. If this ever happens to you and you get to this point, do not allow the app that the bogus bank employees are pushing on you to be installed on your phone. If you do, they will ask you to check your bank accounts for fraudulent transactions. They will do this by asking you to open your banking, securities, or crypto apps. They might ask you to show them the most recent statements from these accounts which can be opened via an app or a website using your phone's mobile browser. The thing is, thanks to the app they asked you to install, whatever you see on your phone, they can see. That's why you should not agree to have the app they suggest you add to your device, installed on your phone, tablet, or any other connected device you use. FBI warns the public about the Phantom Hacker Scam. | Image credit-FBI If you don't heed this warning, the scammers will now know exactly how much is in your account and where that cash is. They will then tell you that they can help you move your money to a safe account, which they promise will keep your money away from the made-up hacker they might have told you earlier was a threat to the safety of your funds. The safe account is actually their own bank account or crypto wallet. The transfer is made, and your money is gone forever. To prevent this from happening to you, do not respond to any text, email, or pop-up that is trying to get you to respond to the missive through your fear. These scammers know that if they make you concerned about a made-up hacker, you are going to respond a specific way, and that way is to follow what they tell you to do. The FBI is calling this the "Phantom Hacker Attack" since the attackers make up the story that the victim's bank account is being threatened by a hacker that doesn't exist. Again, that creates fear and the fear can be used to motivate the victim to install a tracking app. Back in 2023, when this scam was originally the subject of warnings by the FBI, the agency suggested that consumers take the following steps to prevent themselves from becoming another victim: Do not click on unsolicited pop-ups, links sent via text messages, or email links or attachments. Do not contact the telephone number provided in a pop-up, text, or email. Do not download software at the request of an unknown individual who contacted you. Do not allow an unknown individual who contacted you to have control of your computer. The US Government will never request you send money via wire transfer to foreign accounts, cryptocurrency, or gift/prepaid cards. Use your common sense and don't let your emotions take over, driving you to do something or agree to something that you'd ordinarily never do. Switch to Total Wireless and buy 2 months of a 5G Unlimited plan to score the phone free! We may earn a commission if you make a purchase Check Out The Offer
Phone Arena
25-07-2025
- Phone Arena
T-Mobile is sending out checks so large that one customer is happy it was breached
T-Mobile was breached in 2021, affecting 76 million customers. The company was sued by customers for not properly safeguarding their information, and it decided to pay $350 million to settle the claim. The payments have steadily been going out since late May, and, as expected, some people are getting way more money than first spotted by Android Authority , some Reddit users have received more than $4,000 as their breach settlement payment. While that was expected since affected customers were promised as much as $25,000 by the company, it has still surprised a lot of customers, many of whom got $56.54 at highest payouts to customers were meant for those who spent money to minimize the impact of the data theft and protect themselves from future harm. These customers were requested to provide proof of out-of-pocket who spent time mitigating the effect of the breach could asked to be reimbursed for lost time at a rate of $25 per hour or their hourly remaining users were asked to expect a payment of $25, or $100 if they lived in California when the breach happened. Any money left over in the settlement fund was to be reinjected and added to claims on a proportional basis. This may explain why even customers who didn't claim out-of-pocket losses or lost time received more than expected. Some T-Mobile customers have received more than $4,000 as a settlement payment. | Image Credit - Reddit user brokenshells Data breaches are a sensitive matter and put customers at risk, but since it has been four years, the anger has somewhat subsided. That's why customers are joyously sharing their $4,000 checks, even though in a way, this is money that T-Mobile owed to them for what they had to spend as a result of the breach. One customer even joked that they were happy that their information was leaked. This user appears to have forgiven T-Mobile for the breach. | Image Credit - Reddit user OnePiglet3249 After looking at these huge payouts, some customers are regretting not filing a claim form. Others say they did file a claim but haven't received payment yet. The bulk of the settlement pool will be used to pay lawyers, who will apparently receive $46 million. While that's bound to sting, the bigger takeaway here is that T-Mobile was reprimanded for having lax security, and that's what matters more.
Phone Arena
20-07-2025
- Phone Arena
This attack could give criminals control of your mobile or desktop browser
A JavaScript-based redirect attack is serious because it can force your browser (mobile or desktop) to navigate to another website without your consent or even your knowledge. The concern is that your browser could be sent to malicious websites. This attack injects or manipulates JavaScript code on a legitimate webpage. Before you know it, the browser on your phone (or even your desktop computer) makes you the victim of a phishing scam, spyware, keyloggers (recording your keystrokes), and trojans. The goal of this is to obtain the passwords you use, which would allow attackers to access your banking and financial apps. The JavaScript-based redirect attacks are being delivered via Scalable Vector Graphics (SVG) files. These are treated mostly as harmless image files but they can be embedded with script elements design to redirect mobile and desktop browsers to dangerous websites. The destinations of the redirects are determined by the attackers. Example of credentials phishing with the name of the company used by the attackers edited. | Image credit-Ontinue According to Ontinue, the emails use weak or ineffectual email authentication domains. This allows the attackers to get potential victims to open the emails they send by pretending that they were sent by a trusted brands or an individual. The email includes "a call to action" which is an attempt to get the victim to open the image file or preview it on a mobile or desktop browser. Once the image is rendered, the SVG executes the embedded JavaScript silently. The JavaScript execution is achieved and the browser is then redirected without any user interaction. -Ontinue Watch out for emails that get downright pushy about having you view an image file immediately. If an email looks as though it was sent from a company you do business with, look for spelling errors or call the company using a phone number that you find online. You can't trust all business numbers you get from Google since some are crowd-sourced and are open to manipulation by bad actors.
