Phishing credential campaigns via Email Service Providers (ESPs): a dangerous tactic (www.kaspersky.com)
from Squire1039@lemm.ee to technology@lemmy.world on 22 Feb 2024 13:53
https://lemm.ee/post/24529703

Target: Businesses using Email Service Providers (ESPs) like SendGrid to send email campaigns, and the receivers of the emails

Method:

• Gain access to an ESP account: This could be through hijacking a legitimate account or other means.
• Send phishing emails through the ESP: These emails pose as legitimate messages from the ESP, urging users to update security settings (e.g., enable 2FA).
• Use spoofed links: The links in the email appear to point to the ESP’s domain, bypassing usual phishing red flags.
• Redirect to fake login page: Clicking the link leads to a website resembling the ESP’s login page, designed to steal user credentials.

Why it’s dangerous:

• Increased trust: Users are more likely to open emails appearing to come from a familiar ESP.
• Bypassing safeguards: Spoofed links and redirection make it harder to detect the scam.

#technology