Forest Global Training Partners

Cyber Risks · Krebs on Security

SMS Phishers Pivot to Points, Taxes, Fake Retailers

Summary: China-based phishing groups previously known for package and toll-fee scam texts are now selling kits that mass-create fake e-commerce storefronts converting stolen card data into Apple and Google mobile wallets. Krebs on Security reports thousands of domains were registered in the past week spoofing T-Mobile rewards points, with related domains spoofing AT&T and state tax authorities such as the District of Columbia's Office of Tax and Revenue.

Bottom line: SecAlliance's Ford Merrill notes fake shops can go months without being shut down and generally don't get flagged by safe browsing tools, because the malicious code only loads at checkout. The theft completes when a victim hands over the one-time code their bank sent for a wallet enrollment they never initiated.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related