Slick phishing campaign targets NSW govt suppliers

The NSW government is putting its registered suppliers on high alert that a sophisticated phishing email is currently in circulation with the apparent goal of trying to break into the state’s private procurement systems.

NSW Procurement has warned the state’s suppliers to be wary of emails purporting to be from the agency. The authors of the campaign are specifically targeting members of the state’s prequalification scheme for general construction works valued at up to $1 million.

Most of the panel members are small to medium sized construction business and tradespeople.

The email asks members of the procurement scheme - which has 1200 current registered participants - to confirm their business details by clicking a link supposedly taking them to the latest vendor list.

A screen shot of an example email (Source: NSW Procurement)

A spokesman for the Department of Finance, Services and Innovation told iTnews it had received reports that suppliers who clicked through were asked to enter their personal login details for the NSW eTendering website, assumedly to harvest the credentials.

NSW eTendering is the portal used by suppliers to bid for work with state agencies. Access to business accounts could glean protected commercial details stored as part of tender attempts.

“NSW Procurement recommends that no one clicks the link to ensure safety of login details,” a spokesman said. He advised that anyone who wanted to reset their password should visit tenders.nsw.gov.au.

Authors of the highly-targeted email have seemingly gone to some lengths to give it the appearance of authenticity.

The email informs recipients that the government has recently “published an up-to-date list of contractors” that are qualified under the “NSW standard”.

It claims to “strongly advise contractors to check the publication through online cloud storage using their respective email to check the accuracy of the published data and provide feedback”.

The authors even identified the DFSI procurement executives that contractors can take their complaints to, appearing to have copied swathes of text from the NSW Procurement website.

DFSI has asked anyone that has received the email to delete it immediately and report it through the ACCC’s SCAMWATCH website.

The agency says this is the first campaign of its type that has been reported.