Brand impersonation in cyber-attacks has reached new levels of sophistication, a recent research article by Abnormal Security has highlighted.
Traditionally observed in financial institutions and social media sites, threat actors are now employing multi-stage attacks with a high degree of personalization.
A study published by Abnormal CISO, Mike Britton, revealed a case where attackers impersonated the popular streaming service Disney+ in an intricate scheme.
The cybercriminals initiated the attack with an auto-generated notification email about a pending charge for a new Disney+ subscription.
Each email contained an attached PDF named after the recipient - a rarely seen tactic requiring manual effort.
The PDF detailed an inflated charge of $49.99, surpassing regular subscription fees, accompanied by a seemingly legitimate customer support service number.
Notably, the attackers went beyond typical tactics by using a sender email resembling a legitimate Disney+ address, incorporating brand colors, and personalizing subject lines and greetings.
The emails lacked overt signs of phishing, such as misspellings or malware-laden attachments, making them challenging to detect for both traditional security solutions and individuals.
While the technical details of the attack are not explicitly outlined in the Abnormal advisory, the primary attack vectors appear to involve a combination of email spoofing/phishing, attachment-based tactics, phone-based social engineering and brand impersonation.
The study underscored the difficulty for Secure Email Gateways to flag such attacks, given the absence of clear indicators of compromise and reliance on historical data for domain reputation.
Employees, on the other hand, face challenges due to the convincing impersonation of a trusted brand and a sense of urgency.
To combat such attacks, the research article recommends AI-native email security solutions that employ machine learning, behavioral AI and content analysis.
This Cyber News was published on www.infosecurity-magazine.com. Publication date: Tue, 05 Dec 2023 17:30:23 +0000