A recent spate of phishing scams - promoted through counterfeit websites - has prompted warnings from police and local businesses in the United Arab Emirates.
The alerts flag fake websites posing as Dubai's Road and Transport Authority, which runs the metro and bus network in the city, as well as tourist sites such as Global Village and the Museum of the Future.
'Black Hat' SEO Poisoning Scammers are attempting to duplicate a legitimate website or app using a counterfeit domain, often with the false veneer of legitimacy through a digital certificate, and promoting them using so-called black hat search engine optimization.
Chris Hauk, consumer privacy advocate at Pixel Privacy, says cybercriminals can use various techniques to improve the ranking of their scam pages.
This can include keyword stuffing, where relevant keywords are crammed into a webpage's text or meta tags; search ranking manipulation, which uses bots or humans to search for keywords and generate fake clicks for the malicious site; and cloaking, which involves offering search engine crawlers with different information than what is actually displayed to visitors to the site.
Rew Whaley, senior technical director at Promon, explains that one of the most prevalent ways that criminals boost their page is by buying an HTTPS domain.
Anyone can pay for the certificate and have a legitimate-looking website.
Watering Hole Attacks Experts tell Dark Reading that some recent Dubai-targeting scams display the hallmarks of watering-hole attacks.
He says the attack typically requires the user to enter their credentials, and even one-time password codes, which are harvested and subsequently abused.
Phishing Oasis As well as scam websites impersonating legitimate public services, phishing emails have become more prevalent in Dubai recently.
These urge recipients to click on links to pay fictitious fines or service fees while falsely posing as either emails or SMS messages supposedly sent to them by trustworthy organizations, such as the local police force.
This has led Dubai police to warn people about phishing scams where fraudsters posed as cops.
Replies to the thread report that as well as sending messages, the fraudsters call prospective marks in an attempt to trick them into handing over their Emirates ID details.
This Cyber News was published on www.darkreading.com. Publication date: Thu, 11 Jan 2024 19:35:04 +0000