Scammers Vehemently Perform Phishing on LinkedIn Accounts

Symantec the security company warns of scammers who keep on vehemently targeting social-networking websites for different purposes, including digging out private credentials with which to compromise and access users' accounts such as they are doing on LinkedIn the professionals social media site.

Actually lately, scammers attacked members of LinkedIn as they sent them phishing e-mails asserting as being LinkedIn Support messages. In those fake e-mails, supposedly unusual operations were cited on the members' accounts which required certain mandatory security update of such accounts. Essentially, the purpose was to get recipients towards taking down one attached form of the HTML kind as well as do as per the instructions given.

Senior Security Response Manager Satnam Narang at Symantec writes that the HTML attachment in reality is one spoofed login page and site of LinkedIn; however, the site's script within that HTML file comes altered that makes the account credentials of a member who accesses LinkedIn get transmitted onto the attackers' repository. Cio.com published this, January 14, 2015.

Narang continues that the file in attachment likely aids the electronic mails in defeating spam filters.

According to him, the technique evades browser blacklists which usually labels dubious websites thus enabling end-users remain protected against getting phished.

Narang further observes a modification in the LinkedIn term inside the spam mail where instead of using the upper case "I" the lowercase "i" is put. Consequently, the e-mail bypasses recognition by anti-spam filters while the difference remains unnoticed to users.

Significantly, the attackers managed in escaping automatic detection as well as make a phishing site that even lasted long; however, the fact is that websites don't conduct updates, especially security updates via dispatching e-mails to consumers.

Senior Security Analyst Fred Touchette with AppRiver stated that scams of the above kind were getting more-and-more frequent so enterprises required adopting the necessary safeguards. V3.co.uk reported this, January 15, 2015.

Meanwhile, it's advisable that LinkedIn account-owners enable the dual-factor validation security feature which's possible via the profile's included security and privacy configurations while it makes sure that incase user's password/username go missing, another code dispatched onto his mobile-phone can be used for logging in.

» SPAMfighter News - 1/24/2015