{"id":8549,"date":"2023-02-28T15:52:14","date_gmt":"2023-02-28T23:52:14","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=8549"},"modified":"2024-04-26T14:00:58","modified_gmt":"2024-04-26T21:00:58","slug":"recent-sms-phishing-attacks-reveal-the-dangers-of-mfa-lookalike-domains","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/security\/recent-sms-phishing-attacks-reveal-the-dangers-of-mfa-lookalike-domains\/","title":{"rendered":"Recent SMS Phishing Attacks Reveal the Dangers of MFA Lookalike Domains"},"content":{"rendered":"

In cybersecurity, the weakest link is often the human element. This proved to be true in a series of recent SMS phishing attacks.\u00a0<\/p>\n

In February, the Coinbase cryptocurrency exchange platform revealed<\/a> that it was the target of a cyberattack that lured one of its employees, via SMS, to log into a company account to read an important message. The employee was taken to a phishing site where he entered his credentials. Once the attacker had the stolen credentials, he tried to login to Coinbase\u2019s internal systems but was not successful due to multi-factor authentication (MFA). After failing to authenticate, the attacker called the employee, claiming to be Coinbase\u2019s IT department. The employee believed the caller to be legitimate and started following the attacker\u2019s instructions. Soon after, Coinbase\u2019s CSIRT (Computer Security Incident Response Team) team saw alerts of suspicious activity from the employee and immediately contacted the employee, at which point he stopped all communications with the attacker.\u00a0 Since then, several other companies have confirmed that they were subject to the same attack, including Reddit<\/a>, Zendesk<\/a>, Twilio<\/a>, DoorDash<\/a>, and Namecheap<\/a>.<\/p>\n

Attackers love phishing because it is cheap and all they need is one person to make a mistake and click on the link. SMS phishing attacks, commonly called smishing, such as the one above have increased in frequency recently, and Infoblox is actively tracking actors who operate massive resilient smishing operations.\u00a0<\/p>\n

Phishing involves tricking the victim into clicking on a malicious link and providing personal information, such as passwords, credit card numbers, or social security numbers. Phishing attacks can start with an email, an SMS, a phone call or social media messages that appear to be from a legitimate source, such as a bank, social media platform, or an online store. The message typically includes a link or attached file for the recipient to click on or open.\u00a0<\/p>\n

Connecting Phishing Attacks to Lookalike Domains<\/h3>\n

Lookalike domains are used in phishing and spear phishing attacks such as the one that targeted Coinbase. Lookalike domains can imitate any organization, including<\/p>\n