Symantec warns of PDF update phishing scam

Staff Writer

Emails seeking to harvest credit card details.

Security experts are warning of a rapidly spreading scam using a fake PDF Reader update and 'free gifts' as hooks.

Symantec Hosted Services said that the company had spotted a large number of emails in circulation, with some degree of variation in their content, but the same end result.

The main aim is to harvest credit card details by lulling people into applying for a non-existent update and offering a free gift.

Clicking on the link takes the recipient to a professional-looking page made to advertise the fictitious software, explained Symantec Hosted Services malware data analyst Mathew Nisbet in a blog post.

Clicking on the download link then takes the victim to a different site altogether, which asks for some personal details.

"The URL claims to be a secure sign-up, though it uses no encryption whatsoever. The section to the left explains that, once a member, the recipient is entitled to 'free' software," said Nisbet.

This is designed to give the victim the impression that the site is legitimate. The 'free gift' is available only for a few hours, which is a common social engineering tactic, according to Nisbet.

More clicks take users through to a credit card payment page designed to harvest information.

"It could also be easily modified to infect the user with malware by offering an infected download at the end of the process, or by attempting a 'drive by' attack anywhere on the site," said Nisbet.

"Any unsolicited email received from an unknown source should be treated as highly suspicious, especially one that requires visiting an external page by clicking a link."

Symantec warns of PDF update phishing scam
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

NSW Police to embark on $126m IT overhaul

NSW Police to embark on $126m IT overhaul

CBA looks to GenAI to assist 1200 'security champions'

CBA looks to GenAI to assist 1200 'security champions'

Australia's super funds told to assess authentication controls

Australia's super funds told to assess authentication controls

WestJet probes cyber security incident

WestJet probes cyber security incident

Log In

  |  Forgot your password?