Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

learn more… | top users | synonyms

2
votes
0answers
36 views

Something phishy going on with email [duplicate]

I own my own domain. For a month or so I've been getting emails from addresses I don't know with "see attached image" or "find the attached invoice", with a zip/rar file attached. Of course, I ...
4
votes
1answer
41 views

How can I safely view the code of a VBA macro?

I have received a phishing email with the usual bogus bill in the form of a Word document. I am curious about what the probable virus wants to do so I would like to inspect the code. At the moment ...
0
votes
1answer
33 views

Is pull inherently more secure than push?

Users of a service are waiting for something to happen - a money transfer for example. An attacker might forge an email notification, that executes an XSRF attack. Alternatively, I could leave it up ...
0
votes
1answer
88 views

What are these links that have been sent to me multiple times on facebook?

2 friends of mine have sent me very suspicious links on facebook, which ask me for credentials on an external site. Entering hello@example.com in the username, and 1234 for the password let me in, and ...
16
votes
2answers
1k views

Ongoing Executive Impersonation Attack

A friend of mine runs a small business that was recently targeted by a relatively sophisticated "executive impersonation" wire transfer spearphishing attack. The attacker registered a domain that was ...
3
votes
1answer
53 views

Sites that allow user-generated content

Is there a way to identify which popular sites will host arbitrary user-generated content? I am doing some analysis to detect phishing sites. It would be nice to use the popularity of a website as a ...
3
votes
1answer
53 views

One of my open files turned into a list of URLs and codes after clicking a link on a phishing email?

So I received a non-filtered email earlier today supposedly from Itunes under my email address with an invoice for Netflix subscription. Some of the links were genuine, but ultimately I clicked on a ...
4
votes
1answer
55 views

Databases with spam, phishing email examples [duplicate]

I'm working on a little project trying to see if I can predict the likelihood that an email is in fact a security risk (phishing, spam, social engineering, etc). I order to do this I need to have a ...
2
votes
1answer
83 views

Unable to Spoof DNS in Kali

I am new to Kali But not new to Information Security. Warming up with Kali, I tried to dns_spoof. But that didn't quite work. Here is what I did. Tampered ip_forward to 1 in /proc/sys/net/ipv4 ...
3
votes
2answers
181 views

“fake” phishing mails from CST

I work in the computer security team of my company and my team leader ask me to send "fake" phishing mails to my colleagues. The mails intended to lure them into clicking on the embedded links (the ...
0
votes
1answer
127 views

Does it Matter That Universal Windows Platform (UWP) is Open to Phishing Attacks?

A few years ago (a little over three now to be exact), I brought up what I consider to be a rather obvious (and serious) security issue with the Universal Windows Platform (UWP): The ability to use ...
1
vote
0answers
144 views

Attackers on sc.imp.live.com [closed]

"Deceptive site ahead Attackers on sc.imp.live.com may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone ...
0
votes
1answer
118 views

SETOOL Kit:Error: “Unable to Clone the site. Check your network connection”

I have to tried to check whether a site is vulnerable to Phishing attack or not using "Setool kit" in Kali Linux. But when I tried to clone a site using this Setool Kit in Kali Linux, I got an error ...
1
vote
1answer
91 views

Spear Phishing attempt, how to respond? [closed]

I'm a software developer for a software development company responsible for multiple products, and I typically handle our IT needs as we're quite a small company. We had a suspicious incident today ...
3
votes
2answers
138 views

Why can't my email server automatically identify spoofed addresses?

I get this question from business stakeholders a lot, and I have tried to solve this problem on my own. I have a potential approach, but I want to challenge my assumptions. In my mind, it should be ...
5
votes
1answer
76 views

Do people use “phising” as a real term, or just a mistaken spelling of “phishing”

Is "phising" a commonly accepted term, or just a mis-spelling of "phishing"? I've always understood "phishing" is a common security term. However, recently I've started seeing serious articles and ...
4
votes
1answer
49 views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
0
votes
1answer
113 views

Phishing Gmail account [duplicate]

I received a mail from a friend who I was playing together in a multiplayer game. And it had a link to phishing page which would ask to login to view the file that the sent me. And my antivirus found ...
-2
votes
2answers
57 views

User's submitted ID in URLs, can it open some vulnerability? [closed]

On the website I'm building users can submit links to various of their personal page: YouTube accounts, Twitter, Facebook and a lot more. When he does so he furnishes the ID to his account. For ...
7
votes
1answer
102 views

fake website used for phishing purposes

Our real web site is www.abc.com. Recently Intel notified us of another web site www.fake.com having some parts of the site appearing the same as our real site. This is obviously a phishing site. Not ...
0
votes
1answer
83 views

“Secure” emails from unfamiliar source(s)

The context is long, so I'll ask my question first. If an encrypted message is received from an unfamiliar sender and it's spam, how can I avoid receiving further messages of the same sort? If it's ...
1
vote
2answers
1k views

Liliane Bettencourt scam? [closed]

I got a text message from an Elizabeth.Zamora@Bridgeportct.gov sub; RE: donations!!! "donation was made to you by Mrs. Liliane Betterncourtm, contact her at: lilianebettencour@163.com" for ...
2
votes
1answer
104 views

Should we trust online banks with our credit card information?

I'm thinking of buying a product for someone using the steam platform. Being in Germany, the best (least expensive) option would be to use a local bank. Logging in, choosing a product and checking out ...
-2
votes
1answer
70 views

Rate The Viability Of My Phish-Proof System [closed]

I have recently finished building my first (and so far only) phish-proof login system and I would like the experts to test it. The system is hosted at http://www.daera.net/noph/nophlogin.htm Is it ...
0
votes
1answer
68 views

SEToolkit cloned website can be viewed over internet, but does not harvest credentials

I've been working with SEToolkit's website cloner/credential harvester. Everything works fine locally: The clone opens on the victim pc, victim inputs credentials, after submitting the victim is ...
6
votes
2answers
527 views

Did scammers take control of a subdomain to host phishing site?

This morning I received a text message (ostensibly) from my bank: We need to contact you. Please visit https://paymentassistance.nationwide.co.uk for more information My spidey sense immediately ...
0
votes
4answers
158 views

Phish Proof Website. Possible? [closed]

Seeing how big names like Gmail, Yahoo! (despite the login seal) and Hotmail (Live Mail) are prone to phishing attacks, this raises the question of whether it is possible (theoretically) to safeguard ...
1
vote
2answers
101 views

How does Stripe Checkout prevent phishing attacks?

The Stripe Checkout overlay (https://stripe.com/checkout) pops up within a site and does not show the associated URL. A malicious website could create its own overlay that looks like Stripe's, and ...
2
votes
0answers
96 views

Installing a cocoapod and 'github' asks for login credentials?

I just added a cocoapod and got this >ls Podfile superApp Podfile.lock superApp.xcodeproj Pods superApp.xcworkspace >pod install Updating local specs ...
3
votes
1answer
59 views

Best way to prevent phishing by turning off HTML links

phishing attacks are very common nowadays. Innocent victims click on suspicious links in emails and get infected. I know that to prevent phishing, one of the ways is to educate users on the proper ...
8
votes
1answer
172 views

How to check if iCloud password popup is legitimate?

I was away from the computer when this popup appeared and I've no idea what triggered it. How do I know if it's legitimate popup from App Store or a phishing attempt by some malware? Back in my ...
1
vote
1answer
39 views

If You Use Secure Sites with Extended Validation Certificates How Much Do You Still Have To Worry About Phishing Sites Impersonating Them?

Was mulling over the issue of protecting users from password-stealing phishing sites when an interesting question that hadn't occurred to me before popped into my head: Let's say that I decide to ...
3
votes
3answers
158 views

Does this concept attack work to harvest credentials and 2FA using offline fake site?

My concept is this: Client connects to Malicious\Eviltwin AP Client connects to www.facebook.com but this one is a fake offline site by the fake dns server Client enters user and password ---> ...
4
votes
0answers
383 views

Finding your 'pornstar name' by combining, e.g. your first pet's name and your mother's maiden name. Was this originally a form of phishing? [closed]

It worked like this -- you were at a party and each person said their first pet's name, e.g. 'Binky' and their mother's maiden name 'Robinson' and the (supposedly hilarious) result was the 'pornstar' ...
5
votes
4answers
115 views

How does a CSRF logout pose a potential threat to a website?

Websites like SuperLogout logs the user out from several websites at one go. I want to know in what way does this pose a potential threat to the users of the website? How can this be combined with a ...
0
votes
1answer
63 views

How much information, at maximum, can a phisher/scammer obtain?

My iPhone was recently stolen and since then I've been receiving messages and emails saying that 'a sound was played on your iPhone' or 'your iPhone was found. Visit here to confirm your location'. ...
18
votes
4answers
5k views

Is there a way to download a PHP file without it being executed?

I recently got a phishing mail of unusually bad quality; "Please imediatly sign in under the following link, as we are your bank, you know"-ish. The link points to an unconvincing URL with .php at the ...
4
votes
2answers
139 views

Phishing/Malware redirection through AdExchange on Android

Issue: Yesterday I discovered a strange behaviour in the Chefkoch.de App. During the search for recipe, Firefox opens up with a (German) phishing warning screen. This happened not only on this ...
2
votes
3answers
89 views

Site hack with email phishing scam [closed]

We have a small business website that has been compromised. They are somehow getting customers order details and contacting them requesting their credit card details. We have had our web team and a ...
7
votes
3answers
251 views

Conducting a succesful phishing test

How do you usually conduct a safe phishing exercise to test the staff's security awareness? How do you ensure that staff are not offended by such an exercise? Would you in some circumstances also ...
1
vote
2answers
102 views

How to prevent phishing mails from being successful? [duplicate]

I'd like to know what the best methods are to prevent success of phising mails. This question contains the following subquestions: What are the best ways to determine incoming phising mails (on a ...
0
votes
0answers
105 views

deliver a malicious payload via a cloned website

I've been tasked with conducting an internal pentest, I'm relatively new to this so please bare with me. Some time ago, I used setoolkit and I would have the option to clone a website and attach a ...
1
vote
3answers
236 views

How to prove ownership of a website?

We all know how banks identify themselves to users. No, not through TLS certificates. The users pay no attention to those. No, I'm talking about branding-- all those fancy logos and stock photos that ...
3
votes
5answers
174 views

How can a user detect when a web server is phishing his credentials?

These days so many websites/apps (including StackExchange) allow logging in using your Facebook, GoogleId, or LinkedIn credentials. Whatever method you choose, you are presented a box to enter your ...
69
votes
6answers
13k views

Why do phishing emails have spelling and grammar mistakes?

Are the spelling and grammar mistakes in phishing emails done on purpose? Is there some wisdom behind it? Or they are simply indicative of the fact that they've been written by someone who does not ...
1
vote
1answer
171 views

Scam caller claimed to have elderly friend's “Windows unique identifier”

An elderly friend received a telephone call similar to this Information Security SE post and this one. The caller claimed that my friend's computer had a problem that needed to be fixed. My friend ...
4
votes
3answers
641 views

What to do when iPhone is successfully phished

My girlfriend watched "some" pages on her iPhone and facebook.you-won.com page appeared. She didn't know how to get rid of that JavaScript alert, so she clicked OK. After that she closed the page, and ...
3
votes
2answers
223 views

Spear phishing data set

Are there any existing data sets of spear phishing emails available? I've found a bunch of data sets of phishing emails, but that's not what I'm looking for. I'm not looking for mass phishing ...
12
votes
1answer
2k views

Fell for phishing scam. Is my gmail account with 2-step verification vulnerable?

I can't believe it happened to me but I entered Gmail account's user-name and password into a website as part of a phishing scam. I use Gmail's 2-step verification and have changed my password. Is ...
7
votes
1answer
364 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...