Cybercriminals in the password theft business are constantly coming up with new ways to deliver phishing emails. Now they’ve learned to use a legitimate Facebook mechanism to send fake notifications threatening to block Facebook business accounts. We explore how the scheme works, what to pay attention to, and what measures to take to protect business accounts on social networks.

Anatomy of the phishing attack on Facebook business accounts

It all starts with a message sent by the social network itself to the email address linked to the victim’s Facebook business account. Inside is a menacing icon with an exclamation mark, and an even more menacing text: “24 Hours Left To Request Review. See Why.”

Added to this are other words which, combined with the above text, look odd. But a manager responsible for Facebook may, in haste or in panic, fail to spot these irregularities and follow the link by clicking the button in the email or manually open Facebook in a browser and check for the notifications.

Either way, they’ll end up on Facebook. After all, the email is real, so the buttons really do point to the social network’s site. A notification is waiting there — with the now familiar orange icon and same threatening words: “24 Hours Left To Request Review. See Why.”

The notification contains more details, alleging that the account and page are to be blocked because someone complained about their non-compliance with the terms of service. The victim is then prompted to follow a link to dispute the decision to block their account.

If they do, a website opens (this time, bearing the Meta logo, not Facebook) with roughly the same message as in the notification, but the time granted to resolve the issue has been halved to 12 hours. We suspect that scammers use the Meta logo this time because they try similar schemes on other Meta platforms — we found at least one “location” on Instagram with the same name: “24 Hours Left To Request Review. See Why.”

After clicking the Start button, through a series of redirects the visitor lands on a page with a form asking initially for relatively innocent data: page name, first and last names, phone number, date of birth.

It’s the next screen where things get juicy: here you need to enter the email address or phone number linked to your Facebook account and your password. As you might guess, it’s this data that the attackers are after.

How the phishing scheme exploits real Facebook infrastructure

Now let’s see how threat actors get Facebook to send phishing notifications on their behalf. They do so by using hijacked Facebook accounts. The account name is changed straight away to the most troubling title: “24 Hours Left To Request Review. See Why.” They also change the profile pic so that the preview shows an orange icon with the exclamation mark already familiar to us from the email and notification.

That done, the message about the account block is posted from the account. At the bottom of this message, a mention of the victim’s page appears after a few dozen empty lines. By default it’s hidden, but on clicking the “See more” link in the phishing post, the mention becomes visible.

Threat actors post such messages from the hijacked account in bulk all at once, each of which mentions one of the target Facebook business accounts.

As a result, Facebook diligently sends notifications to all accounts mentioned in these posts, both within the social network itself and to the email addresses linked to these accounts. And because delivery is via the actual Facebook infrastructure, these notifications are guaranteed to reach their intended recipients.

How to protect business social media accounts from hijacking

We should note that phishing isn’t the only threat to business accounts. There exists an entire class of malware specially created for password theft; such programs are known as password stealers. For this same purpose, attackers can also use browser extensions — see our recent post about their use in hijacking Facebook business accounts.

Here’s what we recommend for protecting the social media accounts of your business:

Always use two-factor authentication wherever possible.
Pay close attention to notifications about suspicious login attempts.
Make sure all your passwords are both strong and unique. To generate and store them, it’s best to use a password manager.
Carefully check the addresses of pages asking for account credentials: if there’s even the slightest suspicion that a site is fake, do not enter your password.
Equip all work devices with reliable protection that will warn of danger ahead of time and block the actions of both malware and browser extensions.

Kaspersky official blog – ​Read More

Two-factor authentication (2FA) with the use of one-time passwords (OTPs) is now often seen as a cure-all against phishing, social engineering, account theft, and other cyber-maladies. By requesting an OTP at login, the service in question provides an additional protective layer of user verification. The code can be generated in a special app directly on the user’s device, although, sadly, few people bother to install and configure an authenticator app. Therefore, sites usually send a verification code in the form of a text, email, push notification, IM message, or even voice call.

Valid for a limited time, this code enhances security significantly. But a magic bullet it ain’t: even with 2FA, personal accounts remain vulnerable to OTP bots — automated software that tricks users into revealing their OTPs through social engineering.

To find out what role these bots play in phishing and how they work, read on…

How OTP bots work

Controlled either through a control panel in a web browser or through Telegram, these bots impersonate legitimate organizations such as banks to trick the victim into disclosing a sent OTP. Here’s how it unfolds:

Having obtained the victim’s login credentials — including password (see below for this is done) — the scammer logs into the victim’s account and is asked to enter an OTP.
The victim receives the OTP on their phone.
The OTP bot calls the victim and, using a pre-recorded social engineering script, asks them to enter the received code.
The unsuspecting victim keys in the code right there on their phone during the call.
The code is relayed to the attacker’s Telegram bot.
The scammer gains access to the victim’s account.

The key function of the OTP bot is to call the victim, and the success of the scam hinges on how persuasive the bot is: OTPs have a short lifespan, so the chances of obtaining a valid code during a phone call are much higher than any other way. That’s why OTP bots offer numerous options for fine-tuning the call parameters.

OTP bots are a business, so to get started, scammers buy a subscription in crypto costing the equivalent of up to $420 per week. They then feed the bot with the victim’s name, number, and banking details, and select the organization they want to impersonate.

For plausibility, the scammers can activate the spoofing function by specifying the phone number that the call appears to come from, which is displayed on the victim’s phone. They can also customize the language, and even the voice of the bot. All voices are AI-generated, so, for example, the OTP bot can “speak” English with an Indian accent, or Castilian Spanish. If a call gets forwarded to voicemail, the bot knows to hang up. And to make sure everything is configured correctly, the fraudsters can check the OTP bot settings by making a call to their own test number before commencing an attack.

The victim needs to believe that the call is legitimate, so, before dialing the number, some OTP bots can send a text message warning about the upcoming call. This lulls the target’s vigilance since at first glance there’s nothing suspicious: you get a text notification from the “bank” about an upcoming call, and a few minutes later they do call — so it can’t possibly be a scam. But it is.

During a call, some bots may request not only an OTP, but other data as well, such as bank card number and expiry date, security code or PIN, date of birth, document details, and so on.

For a deeper dive into the inner workings of OTP bots, check out our report on Securelist.

Not by bot alone

While OTP bots are effective tools for bypassing 2FA, they’re utterly useless without the victim’s personal data. To gain account access, attackers need at least the victim’s login, phone number and password. But the more information they have on the target (full name, date of birth, address, email, bank card details), the better (for them). This data can be obtained in several ways:

On the dark web. Hackers regularly put up databases for sale on the dark web, allowing scammers to buy login credentials — including passwords, bank card numbers, and other data. They may not be very fresh, but most users, alas, don’t change their passwords for years, and other details stay relevant for even longer. Incidentally, Kaspersky Premium promptly notifies you of any data breaches involving your phone number or email address, while Kaspersky Password Manager reports password compromise incidents.
From open-source intelligence. Sometimes databases get leaked to the public on the “normal” web, but due to media coverage they quickly grow outdated. For example, the standard practice of a company on discovering a customer data breach is to reset the passwords for all leaked accounts and prompt users to create a new password at the next login.
Through a phishing attack. This method has an undeniable advantage over others — the victim’s data is guaranteed to be up-to-date because phishing can take place in real time.

Phishing kits (phishkits) are tools that allow scammers to automatically create convincing fake websites to harvest personal data. They save time and let cybercriminals collect all the user information they need in a single attack (in which case OTP bots are just one part of a phishing attack).

For example, a multi-stage phishing attack might go like this: the victim receives a message supposedly from a bank, store, or other organization, urging them to update their personal account data. Attached to this message is a phishing link. The expectation is that upon landing on a site that’s almost identical to the original, the victim will enter — and the phishers will steal — their login credentials. And the attackers will use these straight away to log in to the victim’s real account.

If the account is 2FA-protected, the scammers issue a command to the phishing kit control panel to display an OTP entry page on the phishing site. When the victim enters the code, the phishers get full access to the real account, allowing them, for example, to drain bank accounts.

But it doesn’t end there. Scammers take the opportunity to extract as much personal information as possible, pressuring the user to “confirm their credentials” as a mandatory requirement. Through the control panel, the attackers can request email address, bank card number, and other sensitive data in real time. This information can be used to attack other accounts of the victim. For example, they could attempt to access the victim’s mailbox with the phished password — after all, people often reuse the same password for many if not all their accounts! Once they get access to email, the attackers can really go to town: for example, change the mailbox password and after a brief analysis of mailbox content request a password reset for all other accounts linked to this address.

How to keep your accounts safe

Always use Kaspersky Premium to automatically scan for data leaks affecting your accounts that are linked to email addresses and phone numbers — both yours and your family’s. If a breach is detected, follow the app’s advice for mitigation (at the very least, change your password right away).
If you suddenly receive an OTP, be wary. Someone might be trying to hack you. For details on what to do in this case, see our instructions.
Create strong and unique passwords for all your accounts with Kaspersky Password Manager. Scammers can’t attack you with OTP bots unless they know your password, so generate complex passwords and store them securely.
If you receive a message with a link to enter personal data or an OTP, double-check the URL. A favorite trick of scammers is to direct you to a phishing site by substituting a couple of characters in the address bar. Always take a moment to verify that you’re on a legitimate site before entering any sensitive data. By the way, our protection blocks all phishing redirection attempts.
Never share your OTPs with anyone or enter them on your phone keypad during a call. Remember that legitimate employees of banks, stores, or services, or even law enforcement officers will never ask for your OTP.
Stay ahead of the game. Subscribe to our blog to make your life in cyberspace more secure.

Kaspersky official blog – ​Read More

A security information and event management (SIEM) system can’t remain static; its detection logic needs to constantly evolve. The threat landscape is ever-changing, which means you need to keep adding new rules regularly for effective data analysis. Admittedly, the bulk of correlation rules are inevitably fine-tuned by the internal information security team, but having up-to-date rules out of the box is crucial in easing this process. Another important point is that an SIEM system must be capable of adapting to the evolution of the corporate IT infrastructure, and be prepared to use new event sources – each of which often requires a new normalizer (the mechanism for converting data from arbitrary sources to a single format). We’re constantly working on this, adding new normalizers and correlation rules to the Kaspersky Unified Monitoring and Analysis Platform. This post details what was added in version 3.0.3.

New and refined normalizers

In between versions 2.1 and  3.0.3 of the Kaspersky Unified Monitoring and Analysis Platform, we released 99 update packages with new or improved normalizers. These include 63 updates that provide support for new event sources, and 38 that improve existing normalizers by adding support for new event types and making various refinements and fixes. The remaining updates contain continuously enhanced correlation rules, filters, and other usability-oriented resources.

Other new additions include normalizers that introduce support for the following event sources:

Cisco Prime, for Cisco Prime 3.10 events received through syslog
PowerDNS, for processing PowerDNS Authoritative Server 4.5 events received through syslog
Microsoft Active Directory Federation Service (AD FS), for processing Microsoft AD FS events. The normalizer provides support for this event source starting with Kaspersky Unified Monitoring and Analysis Platform version 3.0.1
Microsoft Active Directory Domain Service (AD DS), for processing Microsoft AD DS events. The normalizer also provides support for this event source starting with Kaspersky Unified Monitoring and Analysis Platform version 3.0.1
NetApp ([OOTB] NetApp syslog, for processing NetApp ONTAP 9.12 events received through syslog; and [OOTB] NetApp file, for processing NetApp ONTAP 9.12 events stored in a file)
RedCheck Desktop, for processing RedCheck Desktop 2.6 logs stored in a file
MikroTik networking hardware
PostgreSQL DBMS
MySQL DBMS
VMware ESXi
Microsoft 365

In addition, our experts have refined the following normalizers:

For Microsoft products: revised the normalizer structure and added support for new products and additional event types
For PT NAD: implemented support for events of the current product version
For UNIX-like operating systems: implemented support for additional event types
For Juniper networking devices: made significant normalizer revisions and optimizations
For Citrix NetScaler: implemented support for additional event types

Updated correlation rules

We’ve significantly improved the content of all existing correlation rules in the SOC Content package, while focusing on validating rule logic and refining the rules with inputs from our customers’ real-life experiences. We’ve also improved the quality of the rule descriptions, including incident description rules.

Along with updating the Russian-language SOC Content package, we’ve also released a full-fledged English-language SOC Content package, fully synchronizing its content with the Russian version. From now on, we plan to update the two packages in sync.

The platform now offers over 500 rules, along with further essential tools such as active lists, filters, and dictionaries.

Correlation rule format

We’re planning to add markup for existing rules soon in accordance with MITRE ATT&CK® tactics and techniques. This will expand the system’s capabilities to visualize the level of protection against all known threats.

When choosing avenues for development, we generally align with the MITRE ATT&CK® knowledge base – the de facto industry standard. We also consider feedback from our customers that we get during pilots, integration projects, consulting sessions, or even in emails received by account managers, as well as the experiences of our own SOC – one of the most successful and skilled teams in the industry.

How updates are delivered to the SIEM system

All the content we develop is distributed through the Kaspersky Update Servers subsystem to shorten delivery times. The subsystem requests updates and notifies of them in automated mode, but lets the operator decide on applying these. This helps administrators receive information about available updates quickly, review the contents of each update, and decide whether to introduce new resources in the infrastructure or update existing ones.

The update subsystem significantly expands the capabilities of the Kaspersky Unified Monitoring and Analysis Platform to respond rapidly to changes in the threat landscape and infrastructure. The option to use it without direct internet access ensures that data processed by the SIEM system remains secure and within the perimeter, while users can get the latest system content updates.

The complete list of event sources supported in Kaspersky Unified Monitoring and Analysis Platform 3.0.3 is available in the technical support section, where you also can find information about the correlation rules. Of course, our SIEM updates aren’t limited to new normalizers and detection logic: we recently wrote about UI enhancements and routine automation.

Kaspersky official blog – ​Read More

Ask anyone how to protect your privacy online, and they’ll probably mention private browsing. Every major browser has it, although the names differ: it’s Incognito in Chrome, InPrivate in Edge, Private Window/Tab in Firefox, and Private Browsing in Safari. All these names evoke a sense of security — even invisibility: like you could browse the web safely and in full anonymity. Alas, this mode is far from being “incognito” in reality, although it is still helpful if you understand how it works and supplement it with anti-surveillance security.

How incognito mode works

In private mode, your browser doesn’t save your browsing history, remember information you enter in web forms, or store the graphics and code of the websites you visit in its cache. The tiny text files called cookies in which websites save your settings and preferences are only stored for as long as the private window stays open, and are deleted when you close it. This way, no traces of your browsing activity are left on your computer.

However, your actions are still visible from the outside. The websites you visit, your browser itself, browser extensions, your ISP, the office or school system administrator, and various advertising and analytics systems — such as those owned by Google — can all still track you.

Some browsers, such as Firefox, include additional privacy measures in private mode. These may include disabling browser extensions and blocking known analytics sites that track users and third-party cookies that weren’t set by the website you’re opening. However, even this doesn’t guarantee complete invisibility.

Five billion’s worth of incognito data

To get an idea of how much information can be collected about incognito users, look no further than the Brown v. Google lawsuit, which ended in the internet giant’s defeat. The company was ordered to destroy “billions of data records” pertaining to the activities of users who were browsing in incognito mode, and collected up until the end of 2023. Data that won’t be deleted immediately must be further de-identified, for example by removing part of each user’s IP address from the records. The court estimated the monetary value of the data to be deleted plus the data that will no longer be collected at a staggering $5 billion. However, affected plaintiffs will have to seek monetary compensation individually, so Google isn’t likely to lose much money.

More significantly for all users though, Google was ordered to start blocking third-party cookies in Incognito mode and generally provide a clearer description of how Incognito works. While Google’s methods for collecting information in Incognito mode weren’t fully disclosed to the public during the legal proceedings, some of the techniques were mentioned publicly: gathering data through Google Analytics, recording IP addresses, and collecting HTTP header data.

None of the above is news or a secret: any website on the internet can collect and use the same data, and this data gets sent out in private mode just fine.

How websites track incognito visitors

By login. If you enter your email, phone number or username, and password on a website, your browser configuration no longer matters: you’ve announced your identity to the website.

Cookies. Although the website can’t read “regular” cookies from your browser as long as it’s running in private mode, it can still set new ones. If you use a private browsing window day in, day out, without closing it, there’ll be plenty of information gathered about your movements around the web.

The IP address. Private browsing doesn’t hide your IP address in any way.

Digital fingerprinting. By combining information transmitted from your browser in HTTP headers with data that the webpage can collect with JavaScript (such as screen resolution, battery level for mobile devices, and the list of installed fonts), the website can generate a digital fingerprint for the specific browser on the specific device and use that later to identify you. Private browsing mode has no effect on this.

All of the above. Advanced analytics and tracking systems try to use a number of techniques to track you. Even if old cookies are unavailable due to private browsing, you can be remembered with an auxiliary method, such as digital fingerprinting. This means that even if you visit an online store in a private browsing mode without logging in, you might still see products you were interested in during previous sessions in your search history.

What you should and shouldn’t do in private browsing mode

😍 Search for a birthday present for a family member. Private mode will come in handy, as the keywords that could spoil the surprise won’t come up in the browsing and search history. It also will reduce the likelihood of the context ads that permeate today’s web, giving away your plan with banners about the subject. However, private mode will be of no help if you sign in to your account at the online store or marketplace and make a purchase, as the website will remember both you and the purchase. The search history and “recently viewed” items also may display on other devices where you’re logged in to the same account, so there’s still a chance of that surprise getting ruined. To sum it up, logging in to any account is a bad idea when browsing in private mode.

🤔 Look for a new job or secretly check medical symptoms. The computer will retain no traces of the activity, but your ISP will, and so will your office network’s system administrator. This isn’t something you should do at work for example, as you can’t rely on private browsing to help.

😡 Download illegal content. Don’t. And if you do download something like that in private mode, your ISP will still have recorded this activity under your account.

😎 Sign in to your account on someone else’s or a public computer. In this case, private browsing is the least you can do to protect yourself. It prevents you from leaving any undesired traces like an account name, web form data, a saved password, or locally stored cookies or personal files — unless you save something manually. That’s a start, but it doesn’t guarantee complete security: public computers are often infected with malware that can steal any data from the browser, with private browsing or not. So if you have to use someone else’s computer, it’s best to make sure it has reliable malware protection. If you’re not sure, we recommend changing your password for each account that you signed in to on that computer and enabling two-factor authentication after you log off and get back to your usual device.

🧐 Sign in to two accounts with the same site. Most browsers make this possible: you can sign in to one of the accounts in regular mode, and to the other — in private mode. This is about convenience rather than privacy, so private mode doesn’t really have any drawbacks when used this way.

What’s better than private browsing?

Private browsing mode is helpful, and there’s no reason to shun it entirely. For maximum privacy though, it should be combined with other measures:

An encrypted data channel (VPN) keeps your ISP and (work) system administrator from tracking your online wanderings, and allows you to change your IP address when visiting websites.
Tracking and ad blockers reduce the likelihood of your being identified by your digital fingerprint. Every browser supports anti-surveillance extensions, available from the official browser extension marketplace.
For maximum security, turn on Private browsing in Kaspersky Standard, Kaspersky Plus, or Kaspersky Premium.
For added secrecy, you can set up a separate browser with the most rigorous tracking protection settings, which our guide can help you select.

Kaspersky official blog – ​Read More

According to the FBI’s 2023 Internet Crime Report, more than 37,500 complaints about fake tech-support scams were reported in the U.S. last year alone — resulting in over $924 million in losses. In this post, we discuss how these scams work, the dangers they pose, and how to protect yourself from this type of fraud.

How fake tech-support scams work

In this scheme, scammers typically impersonate technical or customer-support staff of major companies — most often in the tech industry. This allows the cybercriminals to use impressive-sounding terms and technical details that are incomprehensible to the average user.

The most common pretext under which fake tech-support scammers initiate contact with potential victims is by claiming to have detected some problem on the latter’s computer. For example, fake employees of a software developer or well-known antivirus company call you with a made-up story about their having detected malware on your computer.

Scammers thus overwhelm their victims, instilling panic and a sense of helplessness. The scammers then manipulate these emotions to build trust — these schemes are usually designed to ensure the victim has no choice but to trust the scammer. It’s this trust that the scammers ultimately exploit to achieve their goals.

How fake tech-support scammers find you

To make initial contact with the potential victim, tech-support scammers use a variety of tricks. But in general there are three basic scenarios.

Fake websites and social media accounts

Some scammers create web pages or social media accounts that mimic those of legitimate companies. They may also use search engine or social media ads to promote these fake resources, hoping that potential victims will come to them looking for help with technical issues.

To carry out the attack, the scammers need to be in continuous contact with the victim. For this reason, they usually come up with some pretext to switch communication to phone calls or messaging apps.

Pop-up windows and “problem detected” notifications

Another popular scenario for this scam involves using pop-up windows and notifications that mimic operating system or antivirus warnings. These notifications, usually alarmingly red or orange in color, warn that something is wrong with the victim’s computer — most often that there’s a virus.

Again, since the scammers need to actively communicate with the victim, they usually provide a phone number to call in order to resolve the detected problem.

Phone calls

Finally, the most popular method of contacting victims is direct phone calls. These can be roughly divided into “cold” and “warm” calls. In the former case, fake tech-support scammers simply dial random numbers, often posing as representatives of major companies whose products are widely used. For example, you don’t have to try very hard to find a Windows user.

Warm calls involve using information obtained through breaches or leaks of customer data from certain companies. Naturally, knowing the victim’s name and the products they use gives the scammers more credibility, increasing their chances of success.

What is the main danger of fake tech-support scams?

Looking closer at the figures we started this post with, you’ll notice that tech-support scams aren’t about small charges for non-existent services. The average reported loss is almost $25,000.

This highlights the main danger of fake tech-support: scammers don’t settle for small profits, but instead try to extract as much from their victims as possible. To do this they devise intricate schemes and utilize social engineering techniques.

In particular, tech-support scammers often pressure victims into installing remote-access or screen-sharing software, disclosing or exposing passwords for financial accounts, and sharing one-time transaction confirmation codes. They might even stage elaborate performances involving multiple phone calls from various “company employees”, “financial institutions”, or “government agencies”.

How to protect yourself from fake tech-support scammers

If someone contacts you claiming to be from tech support, warns you of some danger, and asserts that action must be taken immediately — most likely it’s a fake tech-support scammer.

Try not to panic, and avoid doing anything you might regret later. It’s better to discuss what’s happening with someone else, as this can help you identify inconsistencies and holes in the scammer’s story. To buy time, ask them to call you back — say that you’re busy, you have another call, your phone has low battery, or simply pretend to get cut off.

In addition, to protect against scammers, you can take the following measures:

Install a reliable security solution on all your devices and trust its warnings.
Never enter your login credentials while someone else is watching, for example while you’re screen sharing or if someone has remote access to your computer.
Avoid installing remote access software on your computer, and certainly never grant access to strangers. By the way, our protection can warn you about such dangers.

It’s also worth remembering that the people particularly vulnerable to tech-support scams are the elderly. They may not be particularly cyber-savvy, so they need reliable protection more than anyone.

Kaspersky official blog – ​Read More