Security News > 2020 > September > Phishers are targeting employees with fake GDPR compliance reminders

Phishers are using a bogus GDPR compliance reminder to trick recipients - employees of businesses across several industry verticals - into handing over their email login credentials.

"The attacker lures targets under the pretense that their email security is not GDPR compliant and requires immediate action. For many who are not versed in GDPR regulations, this phish could be merely taken as more red tape to contend with rather than being identified as a malicious message," Area 1 Security researchers noted.

Every and any pretense is good for a phishing email, but when targeting businesses, the lure can be very effective if it can pass as an email sent from inside the organization.

So the attackers attempted to make it look like the email was coming from the company's "Security services", though some initial mistakes on their part would reveal to careful targets that the email was sent from an outside email account.

"On the second day of the campaign the attacker began inserting SMTP HELO commands to tell receiving email servers that the phishing message originated from the target company's domain, when in fact it came from an entirely different origin. This is a common tactic used by malicious actors to spoof legitimate domains and easily bypass legacy email security solutions," the researchers explained.

News URL

http://feedproxy.google.com/~r/HelpNetSecurity/~3/uQaqBtLsSVs/