Latest news with #JAMESWT
Yahoo
a day ago
- Business
- Yahoo
Booking.com phishing scam uses secret characters to trick victims - last-minute holiday hunters beware
When you buy through links on our articles, Future and its syndication partners may earn a commission. Cybercriminals are using the Japanese alphabet to spoof Scammers are targeting people with listings on the site Users are advised to carefully review incoming messages Cybercriminals are spoofing with a clever use of Unicode characters in their phishing landing pages to spread malware. Independent security researcher alias JAMESWT recently reported seeing phishing emails being sent to people listing their real estate on the popular lodging reservation service. In the email, the victims are told that someone complained about their listing, and that they should review it fast or face termination. The email also provides the link which when opened, at first glance looks legitimate. However, upon closer inspection, it can be seen in the URL that instead of the forward dash character '/', the link actually uses 'ん' - a Japanese hiragana character representing the sound 'n'. Typosquatting Hiragana is one of the three main scripts used in written Japanese, alongside katakana and kanji. Those that fail to spot the trick and open the site will get served a malicious MSI installer from a CDN link. The researcher added that samples of the malicious site are already available on the cybersecurity platform MalawareBazaar, and that the analysis already shows the infection chain. It is believed that the attackers are spoofing to deliver infostealers and remote access trojans (RAT). Replacing a single character in the URL, in order to trick victims into opening websites, is a long-established practice. It is called 'typosquatting' and banks on the victims not being careful when reviewing the URL they are opening. being one of the most popular lodging reservation services in the world, is often spoofed in such attacks, together with the likes of Amazon, Microsoft, DHL, and others. Defending against these attacks is relatively easy, and requires users to slow down and carefully review incoming communications, especially unsolicited messages. Double-checking links, attachments, websites, and thinking twice about sharing sensitive data is the best course of action these days. Via BleepingComputer You might also like Microsoft warns about a new phishing campaign impersonating Take a look at our guide to the best authenticator app We've rounded up the best password managers Solve the daily Crossword
Tom's Guide
4 days ago
- Tom's Guide
Booking.com phishing scam is infecting users with malware by using lookalike URLs — don't fall for this
is taking another hit this year thanks to a new phishing campaign that tricks users with lookalike characters to redirect them to malicious websites. Threat actors have been using a Japanese hiragana character – ん – because of its resemblance to a forward slash. At a quick glance, it makes a phishing URL appear legitimate. Initially discovered by independent malware hunter and security researcher JAMESWT, the attack relies on a visual similarity between characters so that scammers can create URLs that will fool users who don't inspect them closely. The text in the malicious emails resembles the actual web address too because it also abuses the Japanese hiragana character which can pass for a '/n' or '/~' letter pattern. While the text in the malicious emails resembles a address the hyperlink points to a URL that contains the hiragana character. When a user looks at the address in a web browser, the characters can look more like a subdirectory web address. However, victims tricked into clicking the link are sent to a malicious MSI installer which is used to drop further payloads which could include things like infostealing malware or remote access trojans. Investigation and reporting from Bleeping Computer, shows that a similar campaign that uses a misspelling of Intuit is also being distributed – this one uses a lookalike domain that opts for an 'L' instead of the 'I' in Intuit. The emails appear to come from, and take users to, an email address but have an intentionally narrowed view so that mobile users will be encouraged to click on 'verify my email' without inspecting or checking the link. Either way, the tactic here is to use a homoglyph in the phishing scheme – a character that looks similar to others but belongs to a different alphabet or character set. Visually similar characters can be – and often have been – exploited in phishing attacks and software developers will work to stay ahead by making it easier for users to distinguish between the distinct characters. It's always recommended for users to hover over a link to see where it will take you before clicking. Also, check the end of a domain before the backslash to check the registered domain. Given the homoglyphs similarities, this can be tricky, which is why it's worthwhile to always have one of the best antivirus software solutions installed on your computer to protect you from any potential malware infections. Follow Tom's Guide on Google News to get our up-to-date news, how-tos, and reviews in your feeds. Make sure to click the Follow button. Get instant access to breaking news, the hottest reviews, great deals and helpful tips.
