Security experts warn of a new hybrid phishing campaign impersonating the Social Security Administration (SSA) that tries to trick recipients into calling criminal call centers.
Armorblox claimed to have blocked fraudulent emails for at least 160,000 customers.
Malicious messages are sent in time for tax season. The subject line of the email, “due to false and suspicious activity,” is designed to create enough anxiety and urgency for the recipient to open the message.
Other social engineering techniques include using the recipient’s legitimate email address at the beginning of the message to personalize the message, or adding a customized sender name of “Social Security Administration-2521”. included.
For more information on vishing attacks, see Vishing makes phishing campaigns 3x more successful.
The email itself informs the user that their social security number account has been suspended due to suspicious activity. If you open the attached PDF, you will see a letter verifying the same information, disguised as written on the SSA letterhead.
“With the Social Security Administration logo in the upper left corner, which is also used as a watermark, the suspension letter provides little to no explanation of the reasons behind the decision to terminate the SSN account.” explains Armorblox.
“The letter’s candor includes a signature ‘wish you good luck in your future’ and a phone number for any questions the recipient wishes to address.”
The letter contains the case number, the surrogate commissioner’s signature, an e-mail reference ID, a customer service contact number, and an SSA address to further legitimize the fraudulent activity.
“The primary action the malicious actors attempted to facilitate through this email attack was to call a customer service number containing the recipient. There are two separate mentions of safe measures. Moving this attack from email to phone calls is a true vishing attack,” Bender said.
Armorblox did not call the number in question, but malicious call center operatives collect more personal and financial information from victims for use in identity fraud and other fraud. may be waiting for
An August 2022 PhishLabs report revealed that this type of hybrid vishing attack increased by more than 600% from Q1 to Q2 2022.
