New Netflix phishing scam steals personal data and payment details: Report

By Digit NewsDesk | Published on 29 Jul 2020
HIGHLIGHTS

Netflix scam attempts to steal personal and payment details

Phishing attack remains undetected by email security systems

Netflix scam discovered by Armorblox

New Netflix phishing scam steals personal data and payment details: Report

#IBMCodePatterns, a developer’s best friend.

#IBMCodePatterns provide complete solutions to problems that developers face every day. They leverage multiple technologies, products, or services to solve issues across multiple industries.

Click here to know more

Advertisements

A new Netflix phishing scam has come into light that attempts to steal your personal and credit card information. Moreover, the phishing email is able to bypass mail security measures in place to block such scams in the first place. This new Netflix Credential Phishing attack was first discovered by Armorblox researchers, which is a cloud office security platform. 

In a blog post, the researchers report that they identified a targeted phishing attack that disguised itself to resemble like Netflix Support. The emails sent to Netflix customers are designed to look like a billing failure message which redirects to a fake Netflix website. This credential Phishing attack works a lot on social engineering, in which the victim is made to believe they are at fault. In this case, the phishing email required the users to update their information on Netflix within 24 hours, pending which their subscription stands cancelled. 

Netflix phishing scam: How does it work?

An attacker sends a phishing email that has been designed in a way to elicit an immediate response from the user. The aim of this email is to take the user to the Netflix lookalike website where the user willingly submits their login credentials, billing address and credit card details. Once these details are successfully recorded, the victim gets a notification prompt saying “Success” and redirects them to the Netflix login page. 

The email has been disguised as a “Notice of verification failure” which gives it that authenticity that the user prioritizes their attention to the mail. This is also the reason why it remains undetected by email security such as Office 365 Exchange Online Protection as it doesn’t look like a fake email.

Once the user clicks on the link, it redirects to a captcha page that’s made to look like Netflix with the brands black and red colours. The report also notes that all the pages of this website are hosted on legitimate domains and hence security measures in place are unable to detect it in time. The user is then prompted to Sign In for collecting their login data, followed by prompts to fill billing address and payment details. These three steps ensure that the attackers get the victim’s Netflix login credentials, address and credit card details, leaving the user susceptible to more financial harm.

This Netflix scam banks on the user's inability to look past the superficial construct of the landing website which is hosted on a different URL than Netflix. To protect yourself against such scams, ensure that you click on a link in an email only after verifying the redirection link and keeping a tab on URL’s that come from unknown emails.

 
logo
Digit NewsDesk

The guy who answered the question 'What are you doing?' with 'Nothing'.

Digit caters to the largest community of tech buyers, users and enthusiasts in India. The all new Digit in continues the legacy of Thinkdigit.com as one of the largest portals in India committed to technology users and buyers. Digit is also one of the most trusted names when it comes to technology reviews and buying advice and is home to the Digit Test Lab, India's most proficient center for testing and reviewing technology products.

We are about leadership-the 9.9 kind! Building a leading media company out of India.And,grooming new leaders for this promising industry.

DMCA.com Protection Status