Top global airline companies have been compromised by fraudsters for the second time during the last six months.
This time, criminals used the tried and tested "gift" scheme for promotion on Facebook: "Lufthansa is giving away 2 tickets!" These posts are actively shared by colleagues, friends and acquaintances – and under the influence of the freebie strategy and their friends, a person goes on a website with an airline company's logo. Fraudsters deliberately create addresses using names of famous brands in order to put people off their guard. This technique is called spoofing.
To get the free air tickets, a user is prompted to answer a few simple questions: "Have you ever traveled with our company?", "Do you really want to get 2 free tickets?", and "Confirm that you are an adult". After that, the message "Lufthansa is giving away 2 tickets!" and a photo of two boarding passes with the airline's logo are displayed. To get them, a user needs to like the webpage and share the post among their friends in their account. That is how you may unknowingly involve your friends in the fraudulent scheme.
Of course, there are no free air tickets. The best of the 'worst' case scenarios is that a user is redirected to an advertising page and fraudsters receive money for increased traffic. Now, this viral campaign has started in Europe – the first posts have been shared by Facebook users abroad. On September 26, Lufthansa notified users about the fake campaign on its official Facebook page and urged passengers to resist provocations and think about their security!
Lufthansa is not the only company that has faced such troubles. Specialists of the Group-IB CERT (Computer Emergency Response Team) revealed that at least 86 domains had been registered in the name of a certain Rachita M. since August 31 and that those domains used international airline companies' names: Air Canada, Swissair, British Airways, Air-France, Austrian Airlines, and others. Fraudsters made photos of the companies' official board passes for each fake campaign, and the questionnaire was prepared in the airlines' national languages.
A similar large-scale fake campaign was tracked this June. Specialists of Group-IB's Investigation Division found out that fraudsters used airlines' brands to increase traffic on the websites of clients of an American company providing website and mobile app promotion and monetization services. In some cases, users were asked to provide their personal information: name, email, phone, date of birth, and address, or were signed up for paid services.
This time, the ultimate goal of the campaign is unclear – users are not forwarded anywhere. Some of the detected phishing websites with questions do not open – it may be the case that fraudsters are just preparing for a large-scale campaign.
The danger here is that this scheme can be used by hackers for cyberattacks. Special people – traffers – redirect users from popular websites to malicious ones where money stealing Trojans are downloaded. Your computer may be connected to a botnet to conduct DDoS attacks or used to mine bitcoins.
Comments
Post a Comment