Security News > 2022 > March > Phony Instagram ‘Support Staff’ Emails Hit Insurance Company

A phishing campaign used the guise of Instagram technical support to steal login credentials from employees of a prominent U.S. life insurance company headquartered in New York, researchers have revealed.

According to a report published by Armorblox on Wednesday, the attack combined brand impersonation with social engineering and managed to bypass Google's email security by using a valid domain name, eventually reaching the mailboxes of hundreds of employees.

Disguised as an alert from Instagram's technical support team, it indicated that the recipient's account was under threat of deactivation.

Targets who did so ended up on a landing page, where they were asked to submit their Instagram account login information.

Just a few weeks ago, cyberattackers impersonated the DocuSign e-signature software to steal Microsoft account credentials from a U.S. payment solutions company.

"To protect against these attacks, employees should be educated on the value of their email accounts," wrote Erich Kron of KnowBe4, via email.

News URL

https://threatpost.com/phony-instagram-support-staff-emails-hit-insurance-company/178929/