Instagram users are targeted by a fresh phishing campaign to send out their credentials with counterfeit copyright alerts, which implants a sense of urgency to reduce user guards.

The phishing emails circulated during this campaign use fake suspension messages allegedly caused by a copyright notice and ask them to complete a’ copyright objection form’ within 24 hours.

Crooks use phishing to trick them into passing sensitive information through fraudulent websites that they control with the aid of various techniques of social engineering.

Fake alerts of copyright infringement

“No one wants to get locked out of their social media account, even temporarily, over an unresolved argument about an image,” says Sophos’ Paul Ducklin who analyzed these phishing attacks.

“Therefore, the tentative to click the email link is high–especially if you know that the’ controversy’ is fake or readily resolved, perhaps because you think you can quickly prove you took the photos yourself.”

The phishing messages are aimed at closer look at what official Instagram messages look like to keep suspicions from raising before the possible victims click the “Copyright Objection Form” button and get redirected to the phishing landing page.

Phishing email, interstitial, and landing page

Phishing email, interstitial, and landing page

However, prior to accessing the phishing site, the targets will first see an interstitial that will boost an urgent impression that their accounts “will be deactivated within 48 hours, unless you provide feedback.” This should give the target users at least some kind of clue that something’ phishy’ as the phishing e-mail says that their accounts will be suspended.

The attackers use an infringement-infraction.[phishingdomain].cf subdomain (.CF is the high level country code for the Central African Republic) for the interstitial and the phishing landing page that contributes to the illusion that the domain is Instagram on mobile browsers.

The two websites have been provided with a valid Let’s Encrypt HTTPS certificate and displayed with green padlocks to relieve user doubts that the website that they’re on is the true deal. This shows that even if you see a green lock that announces a secure link, it is also necessary to check if the domain is valid.

The phishing landing page also shows an age confirmation form that will likely add further credibility to the attack.

Once the goals enter their username and password and press the’ Send’ button at the bottom of the phishing page, they can immediately download their credentials to an attacker-controlled storage server that can be reached from the same.cf.Decoy pages displayed after exfiltration

Decoy pages displayed after exfiltration

Another effort to distract the attention of the victims and to prevent increasing suspicion is produced by showing a charging page after the click of “Submit” button and the decoy page stating that copyright objection was filed. Victims should also wait 24 hours for Instagram to contact them via email.

If the victims fall for the last trick, this would enable the assailants to take control of their accounts without being disturbed by the procedure of taking them into consideration.

Last but not least, the victims are automatically redirected to the official login page in Instagram as a last attempt to maintain the illusion that everything is fine.

After being hacked or phished, what should you do?

Some Instagram users are bound to fall for these kinds of scams as phishers return almost every month with fresh assaults.

In the last month, for example, Instagram users were targeted by a phishing campaign using login attempt warnings and 2FA codes to make the attack more credible.

In April, two series of phishing attacks in Instagram, known as the HotList and the Nasty List, took place on the social network, attempted to steal login credentials and spread via previously hacked accounts that sent messages.

If you have stolen your Instagram credentials or hacked your account, but still have access to your account, you should first check whether the right phone number and email address are still associated with your account.

To do so, click Edit Profile, then scroll down to see the present email address and telephone number. If the attackers have altered them, attempt entering your right information. After this, you should also alter the password of your account by following the Instagram directions.

If you change the password, all presently registered phones will automatically log out of your account to allow you to login to regain complete control of your Instagram account.

Below are the guidelines for Instagram to do if you can still log into your account:

• Change your password or send yourself a password reset email
• Revoke access to any suspicious third-party apps
• Turn on two-factor authentication for additional security

However, you may use these directions to report the event to Instagram’s safety if you have lost access to your account altogether. Instagram will restore your identity via the picture, “e-mail address or telephone number you registered with and type of device you used when you registered.”

 

Categorized in: