From the Duo security blog: The Latest Phishing Attacks Target Gmail, Microsoft Word & Android Apps
The old wisdom said “Don’t trust any e-mail or attachment from someone you don’t know.” Unfortunately, your friends are pretty likely to click any old link they receive from anywhere, so be extra suspicious of suspicious e-mails from people you do think you know.
Last week, friends of Kyle and Kelly Peron got a disturbing email that appeared to be from the couple, a husband-and-wife magic act. It told of trouble overseas, claiming that the two had been mugged while vacationing briefly in the Phillipines. “We’ve been to the Embassy and the Police here but they’re not helping issues at all and our flight leaves in few hours from now but we’re having problems settling the hotel bills and the hotel manager won’t let us leave until we settle the bills,” the email pleaded. “Please, let me know if you can help us out?”
If the email had been from the Perons, it would have been some serious magic—seeing as they were at home in the Philadelphia area at the time. Like many people who use social media to promote their businesses and keep in touch with colleagues and customers, the Perons’ personal information was easily converted into a bit of social engineering that could fool the less skeptical.
The email, which asked for the pair’s friends to wire $2,500 by Western Union to the couple at an address in Manila, turned out to be an example of the latest mutation of the sort of friend-stranded-overseas scam that has run rampant through Facebook for years. Because of new password recovery schemes and other counter-fraud schemes being used by Facebook to prevent the social network from being used directly by fraudsters, the new modus operandi is much more subtle—and much more difficult for those being impersonated to stop. And once a scam’s been exposed, they quickly move on to another target.