Walmart-Themed Phishing Attack Says Your Package Was Not Delivered - Binary Defense

Threat Watch

Threat Watch Walmart-Themed Phishing Attack Says Your Package Was Not Delivered

Walmart-Themed Phishing Attack Says Your Package Was Not Delivered

A new Walmart-themed phishing campaign has been identified by threat researchers. The scam attempts to steal personal information and verifies email addresses to be used in further attacks. The phishing email pretends to be from Walmart and contains the subject line “Your Package delivery Problem Notification lD#” and asks users to confirm their shipping address to ensure delivery. The email contains an “update my address” link which if clicked, prompts users to send their mailing address to the threat actor. The stolen information is then used to conduct identity theft attacks, gain access to the victim’s other accounts, or perform targeted spear-phishing attacks.

ANALYST NOTES

Phishing scams are some of the easiest attacks for criminals to carry out, and the easiest to fall for. The best way to protect against phishing campaigns is training and awareness. Teaching employees how to spot a phishing email can be a great defense. Identifying suspicious URLs or email addresses using an email security filtering service, or employees knowing when an attachment may be malicious can prevent an attack brought on by a phishing email. If email filtering is in place, defenders can block zip file attachments that contain JavaScript or VBScript files. Another useful preventative control to deploy is a group policy update to set the default program for handling .js and .vbs file extensions to Notepad or another text editor program, so that employees double-clicking a script file do not automatically execute it on their workstation. Multi-factor authentication also provides a strong barrier against phishing attacks because it requires an extra step for cyber criminals to overcome in order to conduct a successful attack. According to Microsoft, using multi-factor authentication blocks 99.9% of attempted account hacks. Companies should also utilize a service such as Binary Defense’s Managed Detection and Response service to monitor endpoints for any abnormal activity and identify attacks early before they can cause damage.

https://www.bleepingcomputer.com/news/security/beware-walmart-phishing-attack-says-your-package-was-not-delivered/