Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

learn more… | top users | synonyms

4
votes
1answer
41 views

How can I safely view the code of a VBA macro?

I have received a phishing email with the usual bogus bill in the form of a Word document. I am curious about what the probable virus wants to do so I would like to inspect the code. At the moment ...
2
votes
0answers
36 views

Something phishy going on with email [duplicate]

I own my own domain. For a month or so I've been getting emails from addresses I don't know with "see attached image" or "find the attached invoice", with a zip/rar file attached. Of course, I ...
1
vote
2answers
83 views

Unsolicited opt-out from data brokers

I received several automated emails at an early hour from several data brokers (e.g., Spokeo) asking me to confirm an opt-out for my email address and name. I did not request these, but did so about ...
3
votes
1answer
53 views

Sites that allow user-generated content

Is there a way to identify which popular sites will host arbitrary user-generated content? I am doing some analysis to detect phishing sites. It would be nice to use the popularity of a website as a ...
0
votes
1answer
33 views

Is pull inherently more secure than push?

Users of a service are waiting for something to happen - a money transfer for example. An attacker might forge an email notification, that executes an XSRF attack. Alternatively, I could leave it up ...
6
votes
2answers
383 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
16
votes
2answers
1k views

Ongoing Executive Impersonation Attack

A friend of mine runs a small business that was recently targeted by a relatively sophisticated "executive impersonation" wire transfer spearphishing attack. The attacker registered a domain that was ...
0
votes
1answer
88 views

What are these links that have been sent to me multiple times on facebook?

2 friends of mine have sent me very suspicious links on facebook, which ask me for credentials on an external site. Entering hello@example.com in the username, and 1234 for the password let me in, and ...
3
votes
1answer
53 views

One of my open files turned into a list of URLs and codes after clicking a link on a phishing email?

So I received a non-filtered email earlier today supposedly from Itunes under my email address with an invoice for Netflix subscription. Some of the links were genuine, but ultimately I clicked on a ...
4
votes
1answer
55 views

Databases with spam, phishing email examples [duplicate]

I'm working on a little project trying to see if I can predict the likelihood that an email is in fact a security risk (phishing, spam, social engineering, etc). I order to do this I need to have a ...
2
votes
1answer
83 views

Unable to Spoof DNS in Kali

I am new to Kali But not new to Information Security. Warming up with Kali, I tried to dns_spoof. But that didn't quite work. Here is what I did. Tampered ip_forward to 1 in /proc/sys/net/ipv4 ...
3
votes
2answers
181 views

“fake” phishing mails from CST

I work in the computer security team of my company and my team leader ask me to send "fake" phishing mails to my colleagues. The mails intended to lure them into clicking on the embedded links (the ...
0
votes
1answer
127 views

Does it Matter That Universal Windows Platform (UWP) is Open to Phishing Attacks?

A few years ago (a little over three now to be exact), I brought up what I consider to be a rather obvious (and serious) security issue with the Universal Windows Platform (UWP): The ability to use ...
31
votes
2answers
4k views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a hidden HTML div that's about selling shoes...! I googled the text in question and voila: thousands of sites have been hacked. Check this ...
1
vote
0answers
144 views

Attackers on sc.imp.live.com [closed]

"Deceptive site ahead Attackers on sc.imp.live.com may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone ...
5
votes
4answers
115 views

How does a CSRF logout pose a potential threat to a website?

Websites like SuperLogout logs the user out from several websites at one go. I want to know in what way does this pose a potential threat to the users of the website? How can this be combined with a ...
7
votes
4answers
2k views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
1
vote
1answer
171 views

Scam caller claimed to have elderly friend's “Windows unique identifier”

An elderly friend received a telephone call similar to this Information Security SE post and this one. The caller claimed that my friend's computer had a problem that needed to be fixed. My friend ...
18
votes
4answers
5k views

Is there a way to download a PHP file without it being executed?

I recently got a phishing mail of unusually bad quality; "Please imediatly sign in under the following link, as we are your bank, you know"-ish. The link points to an unconvincing URL with .php at the ...
0
votes
1answer
119 views

SETOOL Kit:Error: “Unable to Clone the site. Check your network connection”

I have to tried to check whether a site is vulnerable to Phishing attack or not using "Setool kit" in Kali Linux. But when I tried to clone a site using this Setool Kit in Kali Linux, I got an error ...
1
vote
1answer
91 views

Spear Phishing attempt, how to respond? [closed]

I'm a software developer for a software development company responsible for multiple products, and I typically handle our IT needs as we're quite a small company. We had a suspicious incident today ...
3
votes
2answers
138 views

Why can't my email server automatically identify spoofed addresses?

I get this question from business stakeholders a lot, and I have tried to solve this problem on my own. I have a potential approach, but I want to challenge my assumptions. In my mind, it should be ...
5
votes
1answer
76 views

Do people use “phising” as a real term, or just a mistaken spelling of “phishing”

Is "phising" a commonly accepted term, or just a mis-spelling of "phishing"? I've always understood "phishing" is a common security term. However, recently I've started seeing serious articles and ...
4
votes
4answers
2k views

One Time Password via Text Message: Possible exploits?

Is there a credible scenario in which the OTP (One Time Password) for online credit card transactions ( specifically for Verified by Visa) can be bypassed? Context: A guy I know was cheated via the ...
4
votes
1answer
49 views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
0
votes
1answer
115 views

Phishing Gmail account [duplicate]

I received a mail from a friend who I was playing together in a multiplayer game. And it had a link to phishing page which would ask to login to view the file that the sent me. And my antivirus found ...
3
votes
3answers
158 views

Does this concept attack work to harvest credentials and 2FA using offline fake site?

My concept is this: Client connects to Malicious\Eviltwin AP Client connects to www.facebook.com but this one is a fake offline site by the fake dns server Client enters user and password ---> ...
-2
votes
2answers
57 views

User's submitted ID in URLs, can it open some vulnerability? [closed]

On the website I'm building users can submit links to various of their personal page: YouTube accounts, Twitter, Facebook and a lot more. When he does so he furnishes the ID to his account. For ...
5
votes
1answer
13k views

Is this Facebook email real or phishing?

I received this email from what is supposedly Facebook today. Here's a screenshot: I was not aware I had credits or credits existed on Facebook and apparently I have $2.30 worth. It looks legitimate ...
7
votes
1answer
102 views

fake website used for phishing purposes

Our real web site is www.abc.com. Recently Intel notified us of another web site www.fake.com having some parts of the site appearing the same as our real site. This is obviously a phishing site. Not ...
0
votes
1answer
83 views

“Secure” emails from unfamiliar source(s)

The context is long, so I'll ask my question first. If an encrypted message is received from an unfamiliar sender and it's spam, how can I avoid receiving further messages of the same sort? If it's ...
1
vote
2answers
1k views

Liliane Bettencourt scam? [closed]

I got a text message from an Elizabeth.Zamora@Bridgeportct.gov sub; RE: donations!!! "donation was made to you by Mrs. Liliane Betterncourtm, contact her at: lilianebettencour@163.com" for ...
2
votes
1answer
105 views

Should we trust online banks with our credit card information?

I'm thinking of buying a product for someone using the steam platform. Being in Germany, the best (least expensive) option would be to use a local bank. Logging in, choosing a product and checking out ...
-2
votes
1answer
70 views

Rate The Viability Of My Phish-Proof System [closed]

I have recently finished building my first (and so far only) phish-proof login system and I would like the experts to test it. The system is hosted at http://www.daera.net/noph/nophlogin.htm Is it ...
0
votes
1answer
68 views

SEToolkit cloned website can be viewed over internet, but does not harvest credentials

I've been working with SEToolkit's website cloner/credential harvester. Everything works fine locally: The clone opens on the victim pc, victim inputs credentials, after submitting the victim is ...
6
votes
2answers
528 views

Did scammers take control of a subdomain to host phishing site?

This morning I received a text message (ostensibly) from my bank: We need to contact you. Please visit https://paymentassistance.nationwide.co.uk for more information My spidey sense immediately ...
1
vote
0answers
294 views

WifiPhisher not creating a fake access point

I recently came to know about WifiPhisher. To test it, I set up an access point using my Windows laptop and tried to obtain its password using this tool in my Ubuntu machine. So, when I run the ...
0
votes
4answers
159 views

Phish Proof Website. Possible? [closed]

Seeing how big names like Gmail, Yahoo! (despite the login seal) and Hotmail (Live Mail) are prone to phishing attacks, this raises the question of whether it is possible (theoretically) to safeguard ...
1
vote
2answers
101 views

How does Stripe Checkout prevent phishing attacks?

The Stripe Checkout overlay (https://stripe.com/checkout) pops up within a site and does not show the associated URL. A malicious website could create its own overlay that looks like Stripe's, and ...
3
votes
4answers
4k views

Yahoo Email Keeps Getting Phished

I keep getting spam emails from myself (and I am sending them to others as well) on my Yahoo Mail account. I have already went through two password changes which I thought were secure. My very last ...
2
votes
0answers
97 views

Installing a cocoapod and 'github' asks for login credentials?

I just added a cocoapod and got this >ls Podfile superApp Podfile.lock superApp.xcodeproj Pods superApp.xcworkspace >pod install Updating local specs ...
3
votes
1answer
59 views

Best way to prevent phishing by turning off HTML links

phishing attacks are very common nowadays. Innocent victims click on suspicious links in emails and get infected. I know that to prevent phishing, one of the ways is to educate users on the proper ...
8
votes
1answer
172 views

How to check if iCloud password popup is legitimate?

I was away from the computer when this popup appeared and I've no idea what triggered it. How do I know if it's legitimate popup from App Store or a phishing attempt by some malware? Back in my ...
5
votes
1answer
140 views

Phishing message in Outlook signature?

One of my organization's users just showed us an interesting problem: every message they tried to send (in OWA 365) contained the following scary text: Your mailbox has exceeded one or more size ...
1
vote
1answer
39 views

If You Use Secure Sites with Extended Validation Certificates How Much Do You Still Have To Worry About Phishing Sites Impersonating Them?

Was mulling over the issue of protecting users from password-stealing phishing sites when an interesting question that hadn't occurred to me before popped into my head: Let's say that I decide to ...
4
votes
0answers
384 views

Finding your 'pornstar name' by combining, e.g. your first pet's name and your mother's maiden name. Was this originally a form of phishing? [closed]

It worked like this -- you were at a party and each person said their first pet's name, e.g. 'Binky' and their mother's maiden name 'Robinson' and the (supposedly hilarious) result was the 'pornstar' ...
7
votes
3answers
2k views

Is this phishing or the real PayPal?

This has all traits of phishing, apart from the extended validation SSL cert. Is this site run by the real PayPal?
4
votes
2answers
139 views

Phishing/Malware redirection through AdExchange on Android

Issue: Yesterday I discovered a strange behaviour in the Chefkoch.de App. During the search for recipe, Firefox opens up with a (German) phishing warning screen. This happened not only on this ...
72
votes
8answers
10k views

How to distinguish between a scam and a genuine call?

My bank called me the other day and the person who spoke to me failed to give me a single evidence that he is calling from my bank. The bank number is hidden just like many other companies maybe ...
0
votes
1answer
63 views

How much information, at maximum, can a phisher/scammer obtain?

My iPhone was recently stolen and since then I've been receiving messages and emails saying that 'a sound was played on your iPhone' or 'your iPhone was found. Visit here to confirm your location'. ...