← Cybersecurity Today
Cybersecurity Today
Top Phishing Exploits fo 2024: Cyber Security Today for Friday, December 13, 2024
00:11:39
Top 5 Phishing Exploits of 2024: Abnormal Security Report and More | Cybersecurity Today In this episode of Cybersecurity Today, host Jim Love delves into Abnormal Security's end-of-year report outlining the top five phishing exploits of 2024 and...
Loading summary
Transcript1 lines
- [00:02]
Jim Love
Abnormal securities End of Year report features what it says are the top five phishing exploits the FTC says beware of job offers via text. Spain busts a vishing ring that defrauded 10,000 bank customers, and the US offers $5 million as a reward to disrupt the North Korean IT worker schemes. This is Cybersecurity Today. I'm your host Jim Love. Abnormal Security released its end of year report featuring what it says are the top five phishing exploits of 2024 and its predictions for what will happen in 2020. Number one is cryptocurrency fraud. These scams target individuals unfamiliar with the complexities of blockchain technology. The schemes often involve phishing emails posing as trusted wallet providers asking users to provide their private recovery phrases to secure their accounts. Attackers exploit the irreversible nature of blockchain transactions to siphon funds, resulting in significant financial losses in 2025. These scams are expected to intensify as cryptocurrency adoption grows, potentially leveraging deep fake videos or AI powered chatbots to increase credibility. File sharing services such as Google Drive and Dropbox were weaponized to bypass traditional email defenses. Attackers used legitimate platforms to host malicious documents that appeared authentic to recipients. For instance, phishing campaigns targeted employees by sharing seemingly official payroll update files that redirected users to credential harvesting sites. As APIs for these platforms become more integrated into workflows, attackers in 2025 are predicted to exploit these interfaces further, using them to create even more convincing scams. And there's multichannel phishing. By combining email, SMS and messaging apps like WhatsApp, attackers used multichannel strategies to evade detection and increase urgency. These campaigns started with phishing emails that shifted communication to less secure personal devices via text or app links. For example, scammers impersonated cryptocurrency exchanges, redirecting victims to WhatsApp to finalize fraudulent transactions. In 2025. Attackers are expected to leverage automated AI driven tools to scale these multichannel attacks and target individuals more effectively. Business email compromise attacks became more precise and scalable during 2024 because of AI. Using generative AI tools, attackers crafted hyper personalized emails mimicking writing styles and and incorporating real time data from social media or prior interactions. These emails often requested wire transfers or confidential information. Looking ahead, 2025 may see AI models becoming even more adept at adapting to specific contexts, posing challenges for legacy email defenses and the fifth email account takeover, which Abnormal Security describes as one of the most damaging threats in 2024. Attackers gain access to corporate accounts through phishing credential stuffing, or social engineering. But once inside, they exploit the trust associated with legitimate email accounts to launch further attacks such as lateral phishing or vendor email Compromise. Again, as APIs and cloud connected applications expand, 2025 is likely to see more of these attacks incorporating automation to scale their reach and sophistication. And for the coming year, abnormal is predicting even more advanced phishing exploits such as AI enhanced phishing, where attackers will use real time data to create contextually relevant scams, blurring the line between legitimate and malicious communication. More API exploits, where malicious actors will increasingly leverage APIs of trusted platforms to obfuscate their activities and scale their attacks. And finally, automation at scale tools that automate phishing processes will lower the barrier for entry, allowing even novice attackers to launch complex campaigns. Which is a good reason to start thinking about either revising your protection and training plans or maybe starting to look around at some of these work from home jobs that you see all the time. But before you do that, the Federal Trade Commission has issued a warning about the alarming rise of task scams, which have caused consumers to lose hundreds of millions of dollars in 2024. These scams, often delivered via text or WhatsApp, promise easy money for small online tasks but ultimately leave victims out of pocket. How does this scam work? The scammers initiate contact through text messages, offering vague job opportunities such as app optimization or product boosting. Initially, the victims are asked to complete simple tasks like liking posts or writing reviews, and they receive small payouts, making the scheme appear legitimate. However, the scammers soon demand a deposit to unlock the next set of tasks, which they claim will result in even bigger rewards. Once the victims pay, the scammers disappear, leaving them with no further work or compensation. So who will fall for this? The FTC data reveals a massive surge in these task scam complaints. In 2020, the agency received no reports of such scams. By 2021 there were five hundred complaints, growing to one thousand in 2022 and five thousand in 2023. But in the first half of 2024 alone, over twenty thousand complaints were filed. Consumers reported losses of approximately two hundred and twenty three million dollars in 2024, with nearly forty percent tied to these text based scams. For comparison, total losses to job scams in 2020 were just 90 million. Just 90 million. So why do people fall for this? Scammers exploit the growing trend of legitimate online micro tasks like labeling data for AI training to lure their victims. By offering small payouts upfront, they build trust before asking for A deposit, often in cryptocurrency. And this tactic gives victims a false sense of legitimacy, convincing them to part with their money. The FTC emphasized. Of course, someone telling you to pay money to get the money you've supposedly earned is a sure sign of a scam. No legit business would ever do that. Spanish and Peruvian police have dismantled a massive voice phishing vishing operation, arresting 83 individuals in a coordinated crackdown. The scam targeted at least 10,000 bank customers, resulting in $3.15 million US in stolen funds. The simultaneous raids across Spain and Peru involved 29 operations led by Spain's Policia Nacional. Arrests included 35 individuals in cities such as Madrid, Barcelona and Mallorca, and 48 in Peru. The alleged leader of the ring was apprehended in Spain and authorities seized cash, mobile phones, computers and detailed scam manuals. During the raids, the scammers operated three call centers employing 50 agents who used stolen databases and scripted social engineering tactics to impersonate bank representatives. Caller ID spoofing technology was used to make calls appear legitimate, with numbers and names matching those of the targeted banks. Victims were told their accounts had been compromised through unauthorized ATM withdrawals and were guided through fake account verification processes. Victims were tricked into sharing one time passcodes sent to their phones, and these codes were then used by operatives near bank branches in Spain to withdraw funds immediately. The operatives kept 20 to 30% of the stolen money, with the remaining proceeds sent to the organization's base in Peru. The scammers also used color coded communication and scattered their operatives across different cities to complicate law enforcement. Tracking the crackdown highlights the growing sophistication of these phishing scams and underscores the importance of vigilance in protecting personal and financial information. The U.S. state Department is getting serious about tracking down North Korean IT worker fraud by offering a reward of up to $5 million for information that leads to the disruption of these schemes. These operations use fake identities to secure remote employment and funnel earnings back to the regime to support its nuclear weapons programs, violating international sanctions. Two front companies, Yanbian silverstar, based in China and Velasses Silverstar, based in Russia, employ over 130 North Korean IT workers, referred to as IT warriors. These workers use stolen or purchased US identities to secure freelance jobs earning up to $300,000 annually. Collectively, they generate hundreds of millions of dollars each year. Their fraudulent earnings are laundered and sent back to North Korea to fund prohibited nuclear activities. The workers deceive employers by creating fake online Personas, registering domains to appear as reputable companies and using sophisticated techniques such as AI tools during interviews. In some cases, when their schemes are discovered, they resort to extortion, threatening to leak stolen data or sabotage systems. The Department of justice has indicted 14 individuals linked to Yanby and Silverstar and Velasses Silverstar for conspiracy, identity theft and money laundering. Led by CEO Johnson Hua, the group has generated at least $88 million over six years. This featured the seizure of nearly $2.3 million in assets between 2022 and 2023, the dismantling of a North Korean laptop farm in China used to impersonate US Workers, and the arrest of Christina Maria Chapman in Arizona for operating another North Korean laptop farm. Earlier this year, cybersecurity firm Knowbefore unknowingly hired a North Korean operative as a principal software engineer. Despite thorough background checks and interviews, the worker used stolen credentials and AI tools to pass as a legitimate candidate. Once hired, they attempted to install malware on company devices. The FBI is warning companies to remain vigilant and enhance their verification processes, monitor employee activity and, of course, educate their staff to recognize red flags like inconsistencies in identities or or overly polished credentials. That's our show for today. You can find links to reports and other details in our show notes@technewsday.com we welcome your comments, tips and the occasional bit of constructive criticism. An editorial at TechNewsday CA I'm your host, Jim Love. Thanks for listening.