Holiday Scams and Malware Campaigns

Print Document

Tweet

Like Me

Share

As the holidays approach, The National Cybersecurity and Communications Integration Center, (NCCIC) reminds users to be aware of seasonal scams and malware campaigns. Users should be cautious of unsolicited emails that contain malicious links or attachments with malware, advertisements infected with malware, and requests for donations from fraudulent charitable organizations, which could result in security breaches, identify theft, or financial loss.

NCCIC recommends the following actions:

• Use caution when browsing the internet, shopping online, and using email.
• Avoid clicking on links or opening attachments in unsolicited emails. See Avoiding Social Engineering and Phishing Attacks for more information.
• Be wary of fraudulent social media pleas, calls, texts, websites, and door-to-door solicitations for donations to charities. See How to Donate Wisely and Avoid Charity Scams for more information.

If you believe you are a victim of a scam or malware campaign, consider the following actions:

• Contact your financial institution immediately, and close any accounts that may have been compromised. Watch for any unexplainable charges to your account. See Preventing and Responding to Identity Theft for more information.
• Immediately change any passwords you might have revealed. Avoid reusing passwords. See Choosing and Protecting Passwords for more information.
• Report the attack to the police, and file reports with the Federal Trade Commission and the FBI's Internet Crime Complaint Center.

Partially reposted from: US-CERT (Computer Emergency Readiness Team) Holiday Scams and Malware Campaigns

Protecting Yourself from Phishing Strategies

Criminals who “phish” use different strategies to obtain your sensitive information. Many times phishing is associated with email but it is any strategy used where the goal is to “phish” sensitive information from you.

You may not realize it, but you are a phishing target at school, at work, and at home. Ultimately, you are the most effective way to detect and stop phishing scams. When viewing email messages, texts, or social media posts, look for the following indicators to prevent stolen passwords, personal data, or private information.

Protecting Yourself

• Keep your Browser Updated. Phishers are exploiting a flaw in the web browsers “punycode.” “Punycode” is in charge of translating foreign domain names into English. This means criminals can register a domain name that, even after close visual inspection, appears normal.

• Misspelling web addresses. Phishers can use a look-alike domain name such as “Goggle.com” hoping that you misspelled “Google.com.” Use bookmarks for trusted websites to avoid manually typing web addresses.
• Be suspicious of websites not using a certificate. A website using a digital certificate indicates that they are the rightful owner of the website. Certified websites will have an image of a lock and in Chrome the word Secure in green letters directly on the address bar. However, just because a website has a digital certificate doesn't necessarily mean that it is safe but it is a good indicator.

ex. Safari Digital Certificate

ex. Chrome Digital Certificate

For more information on how to protect yourself from phishing strategies, visit Manhattan College’s post here. If you feel that you might have been phished click here for more information on what to do next.