Is it a Phish? Halloween Edition

Is it a phish Halloween editionTo wrap up our Cyber Security Awareness Month activities we’re bringing back a crowd favorite, Is it a Phish? And since it’s Halloween, we, of course, had to find the scariest, most terrifying phishing examples we could drum up for our very special guest, T Rex.

Now, Doctor Rex has a great deal of experience when it comes to developing strategies that socially engineer their target victims into having… or becoming… lunch, so now it’s time to turn the tables and see if they can spot the work of modern-day threat actors.

This week Rex reviewed five different suspicious pieces of content that consisted of both emails and websites. Like you, they only had a few moments to decide whether or not the content was suspicious, if they should click on it, or whether to simply mark it as spam. Each of these are real-world examples you’d likely find in your inbox or floating around the web.

Have some good examples of phishing lures, sites, or even suspicious spam emails? Send a screenshot to us on Twitter and we may include it in a future episode.

If there’s one thing the history of evolution has taught us, it’s that phishing attacks will not be contained. Phish break free, they expand to new territories, and crash through barriers painfully, maybe even dangerously, but, uh, well, there it is. – Threat Actor Ian Malcolm

The Results

Hold on to your butts, we’ve got spoilers ahead! Don’t read on if you plan on playing along.

So how did T Rex do? They received a perfect score.

  1. A Halloween themed loan? Suspicious! Yes, that seems a bit odd in general to get quick cash focused around Halloween, but maybe if it were for a Christmas light show that’d be a different situation.
  2. New job opportunity? Let me just click on that attachment… and download some ransomware. T Rex was spot on with this. It on the surface looks safe, but at a closer look there are red flags everywhere. The email comes from a free domain, the attachment is a strange PDF, and the receiver has never talked to that recruiter before.
  3. Just going to log right into your email address… and hand over your credentials for a password reuse attack. Right again, Rex. This is a spoofed Microsoft credential page designed to steal yours.
  4. Time to jump on that cryptocurrency bandwagon, right? Wrong! Although Ethereum is a popular crypocurrency, a closer examination of the page shows the domain is designed to look like the real thing but has some typos in it. T may be a little paranoid here, but there are a lot of issues tied to blockchain organizations.
  5. Someone random person got paid an excessive amount of money, and the FBI is trying to keep that from you. That is so totally legit. Every day people randomly get free money. T Rex may have survived extinction with this one, as it’s your typical 419 scam.

Did you receive a phishing lure or stumble upon a phishing site? Send it to us on Twitter and we can include it in our next edition of Is it a Phish?

*** This is a Security Bloggers Network syndicated blog from The PhishLabs Blog authored by Elliot Volkman. Read the original post at: