New Phishing Scam Reels in Netflix Users to TLS-Certified Sites

guest · Jun 20, 2018

New Phishing Scam Reels in Netflix Users to TLS-Certified Sites
June 20, 2018
https://threatpost.com/new-phishing-scam-reels-in-netflix-users-to-tls-certified-sites/132976/

Researchers are warning of a new Netflix phishing scam that leads victims to sites with valid Transport Layer Security (TLS) certificates.

“With a wildcard DNS record, *anything.domain.com will point to the same IP address,” the researcher said in a post. “The attacker will just use a subdomain/hostname to launch the attack. But I have also seen them use specific domain names registered for the phish.”

The attacker can then obtain a TLS certificate for a host name that is Netflix-related, such as netflix.domain.com or netflix.login.domain.com; this helps the site evade being flagged by safe-browser software. The initial spoofed emails are the weak part of the campaign, and are easy to spot, said Ullrich.

“Once a Netflix account is compromised, it can often be used for a long time undetected as Netflix allows multiple simultaneous streams for its standard and premium accounts,” said Ullrich.
Click to expand...

Palancar · Jun 21, 2018

If Netflix and other large companies would simply enable U2F for their customers this phishing crap would come up empty. Just think of all the bandwidth they are paying for by having tons of "thief" users on their system.

Log in or Sign up

New Phishing Scam Reels in Netflix Users to TLS-Certified Sites

guest Guest

Palancar Registered Member

Log in or Sign up

New Phishing Scam Reels in Netflix Users to TLS-Certified Sites

guest Guest

Palancar Registered Member

Useful Searches