In the past couple of months, Symantec has observed phishing attacks on legitimate automotive sales brands that are based in the UK and the USA. These brands help customers to sell new and used vehicles such as cars, motorbikes, etc. The legitimate websites also provide customers with the facility to advertise the vehicles they wish to sell.

There were several phishing sites created to harvest customers’ confidential information. The phishing sites were hosted on free Web hosting domains. In one of the phishing sites the page stated that the brand was offering customers the opportunity to advertise for free. The customer was required to complete an identity verification (that was fake) so as to avail of the free offer. The verification process prompted for the customer’s email address, the ad’s ID, and a security question with its answer. In this attack the fraudsters attempted to convince customers that the phishing page was authentic by providing the...

In August 2010, Symantec observed phishing websites spoofing a social networking brand that was linked to the film “High School Musical.” Typically, phishing sites are created to appear identical to the original website so that end users will find it difficult to distinguish between them. In the past couple of months, some phishing sites that spoofed social networking brands contained Web pages that were a bit different from the original.

So, why are fraudsters creating these phishing pages that aren’t identical to the original? Fraudsters are modifying the phishing site so that the page looks as though the brand was promoting certain ideas. In many instances, the ideas were associated with celebrities, special occasions, pornography, movies, major events, etc. These ideas are incorporated by modifying certain aspects of the phishing site such as the logo of the brand, Web page background, images, and so on.

In this particular phishing site the...

Symantec recently observed a phishing website spoofing an e-commerce brand’s live support website. Many legitimate brands make use of this facility, in which customers interact with support representatives by chatting online to resolve any issues with the brand’s products or services.

Fraudsters are always looking for new techniques to use in the hunt for users’ information. In many cases, phishing websites that target customers’ login credentials are created by spoofing the login page of the legitimate brand. In this latest case, the phishing site in question is targeting the same types of credentials by spoofing the brand’s live support website. The phishing site involved bogus chat sessions to help the page look more authentic, trying to give customers the impression that the phishing website was interactive.

The phishing page asked for the customer’s...

In July 2010, Symantec observed phishing sites that spoofed the legitimate brands of mobile service providers. (The legit brands are based in the UK and Norway.) Fraudsters are always looking for new techniques with which they can steal customers’ sensitive information for financial gain. With these particular phishing sites, phishers were attacking the telecommunications industry to access customers’ bank accounts.

The phishing sites were circulated by means of spam email messages. Various subject lines were used in an attempt to lure customers—most of the subject lines were related to the customers’ mobile billing statements. In this example, the phishing site stated that the customer had to confirm his or her billing information due to a recent change in contact details. Upon entering the login credentials, the page asks for sensitive information, including contact...