Malicious hackers launching a new phishing campaign that targets Spotify customers to hijacking the user’s account and steal the credentials.
Spotify customers targeted via emails along with malicious links that redirect into a deceptive website which leads users to give away their credentials.
Once users enter their credentials, username and password will be sent to the attacker’s repository of compromised data.
When analyzing the Sender address, it reveals that the Email ID was not originated from Spotify and users spoof the email address and pretending like legitimate is pretty common for nowadays.
Main Phishing Attack Indication
Researcher digs into deep and analyzing the email body and the link that embedded with the mailbox which is obviously not taking into a Spotify page.
According to approver,” the attacker wants the unsuspecting user to click on a green button with the words “CONFIRM ACCOUNT.” Just above the button, the hacker attempts to lure them in further by urging the user to confirm their account to remove restrictions on the account.”
Once click the URL, it redirects victims to a malicious website where users can access the well-designed login page that looks like same as original Spotify login page.
We can see that the URL doesn’t seem to be original Spotify login and also Google marked it as a malicious link
How to stay safe
1. Have a unique Email address.
2. Do not open any attachments without proper validation.
3. Don’t open emails voluntary emails.
4. Use Spam filters & Antispam gateways.
5. Never respond to any spam emails.
Anatomy of Phishing Scam
Related Read
