Well, its here as well after spoofing emails of popular social networking sites like facebook, orkut, etc spammers have now hit upon Twitter. In a recent development, emails are appearing across the internet trying to spoof Twitter’s Administrative communication. Although they would probably be picked up as spam by most email applications, just be cautious and aware that such a thing is happening.
As with many other phishing and spam emails, this one to appears genuine at the outset, but a quick hovering over the URL reveals the true picture and moreover Twitter would not send anything like Administration in the subject. At the point of writing this article this was getting redirected to a website, that was down!
A look at the detailed message header on the parameters like Return-Path, Received-SPF, X-Originating-IP, Authentication-Results etc nails it easily.
Having seen the message headers of the spam/phish email above, I looked up a genuine email from Twitter and was surprised to see additional details like Twitter handle of the Sender, recipient, ID etc
Today morning was just about going as usual till I noticed an email. It seemed to originate from AXIS bank and it had an HTML attachment and it was an important announcement.
The contents of the email looked valid considering Government of India had placed a ban on sending of bulk SMS till 29th. Now I am not sure if such ban holds good for financial institutions. But some smart bloke seems to have capitalized on this ban. The email stated that:
Now unlike the other phishing emails that I have encountered this one seemed different and the content (read grammar) also looks more in line from a professional agency and in tandem with the events that are happening in India.
This is the snapshot of the email:
I opened the HTML attachment, after a customary scan from AV. Now although this looks authentic, but is a bit suspicious because it is asking for too many private details that should evoke second thoughts from anybody. Generally any phishing attack would ask for username, password, cvv details at the max. But this one is prompting for ATM PIN,Transaction password, Secure Code/Verified by Visa, Email details. And unlike others where you enter the details on a site, it is sending an attachment to be filled and submitted. Modus Operandi is slightly different.
I bet someone who is familiar with Axis bank’s online transaction mechanism has set this up because Axis bank requires transaction password in addition to the details mentioned above for a online transaction. Now, the form is a html attachment and when you open everything looks authentic just take a look below.
This is it, but once you look at the page source carefully you will realize the bait. Using the POST method, all details would go to the URL specified instead of Axis bank:
A Whois lookup for the domain above lists that is based out of Poland. All I can do is just notify Axis bank of this. It would have been better if the Government of India or the financial institutions have had made it clear if their services would continue to operate or be impeded due to this SMS ban.
Take care and please spread a word to ensure people do not fall for this
UPDATE:
I would have thought that the content in their email was written by a smart bloke, but it’s actually flicked from Axis Bank’s login page!
11 October
Received another Phishing email with the similar modus operandi , this time targeting ICICI Bank and hosted at:
17th October
Another day, another Phishing email. The phishers are just not leaving any stone unturned as they target every bank with an online presence, this time targeting customers of HDFC Bank and hosted at:
Here is the Phished URL:
Oh Wait..I think I just saw a similar email targeting Punjab National Banks’s customers land in my inbox!….
