A sophisticated phishing campaign targeting Amazon Prime users has emerged, leveraging counterfeit renewal notifications to harvest login credentials, payment details, and personal verification data. Clicking the button redirects users to a fake Amazon security portal hosted on Google Docs, which requests account verification under the pretext of preventing unauthorized access. Researchers at Cofense noted that the campaign’s technical execution reveals advanced social engineering strategies, with threat actors exploiting Google Docs redirects and QR code-based payloads to bypass automated security filters. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. This include the spoofed emails, fake security alerts, and fraudulent payment portals designed to mimic Amazon’s official interfaces. Unlike generic phishing sites, this campaign employs dynamic HTML injection to replicate Amazon’s multi-factor authentication (MFA) interface, including CSS stylesheets and JavaScript validation scripts. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Organizations should deploy email security solutions capable of detecting domain spoofing and inspect embedded links for redirect chains. This intermediate page primes victims for credential theft by mimicking Amazon’s security protocols. A subsequent page requests billing addresses, enabling threat actors to reroute physical mail or execute identity theft. Amazon has reiterated that legitimate communications will never direct users to third-party platforms like Google Docs. While the sender’s display name (“Prime Notification”) appears legitimate, the originating domain uses a lesser-known URL (hXXps[:]//docs[.]google[.]com/drawings/d/1rSqoqN1uTTbP4qnfKzx2ZbvSı), a critical red flag. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 26 Feb 2025 14:00:21 +0000