1. RMM Software Refund Scam
What kind of dastardly criminals would pose as the people who are supposed to protect your network, people like me and my team?
Unfortunately, a lot of them.
Help Desk-themed scams have proven successful in the past and will continue to do so until none of us falls for them anymore. This time, it was employees at the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Multi-State Information Sharing and Analysis Center (MS-ISAC) offices who were targeted.
The attack came in as emails to employees, appearing to be from some kind of IT Support. The messages were designed to get employees to download remote monitoring and management (RMM) software. The kicker is that the RMM software was legitimate. But the criminals used the software fraudulently. (Remember that warning in December?)
“They first connected to the recipient’s system and enticed the recipient to log into their bank account while remaining connected to the system. The actors then used their access through the RMM software to modify the recipient’s bank account summary. The falsely modified bank account summary showed the recipient was mistakenly refunded an excess amount of money. The actors then instructed the recipient to ‘refund’ this excess amount to the scam operator,” CISA reported.
What can you do to protect yourself?
- Always learn the official ways in which legitimate businesses and services will contact you. For example, we email tickets to and from support@infinityinc.us. If you were to receive a message from ITsupport@infinityinc.us, it would be understandable to think that’s us, but it would be a trick.
- Use extra care any time someone asks you to download something, even the ‘help desk.’ Check with a coworker or call to confirm before clicking. There are definitely times when we need to ask a client to download a program or click on a link, and we always prefer you to be safe rather than sorry.
- Remember to be suspicious of anyone asking you to log into your bank account. Most legitimate businesses communicate issues of refunds via letters, not emails and software downloads.
- Make sure everyone is aware of this breach. Share with them the importance of strong, unique passwords for their own protection and yours. Let them know to expect targeted attacks.
- Stay alert for red flags. Scammers keep getting more sophisticated, but you can train yourself to notice when a message or request feels ‘off.’ Trust that feeling and confirm it’s legitimate before taking any action.
2. Super Bowl Betting Scams
The Better Business Bureau’s Scam Tracker is seeing increased reports from people who accidentally placed bets with scam sports betting websites or apps.
The BBB often sees more online betting scams around significant events like the Super Bowl.
Scammers will get you to place a bet online, then make up excuses when you go to redeem money.
Some scammers will want you to deposit more money to get your winnings. The BBB warns against falling for that.
Scam websites often have a letter misspelled in the domain name and re-direct you to a false site to capture your information.
“If you’re betting online, make sure that the website that you’re going to is for the correct company that you want, not something that’s just similar enough,” said BBB of Greater Kansas City Operations Manager Nikolas Reese.
How can you avoid these scams?
- Nationwide or global events will always attract scammers. They know they have the potential to reach a lot of people with minimal work. From sporting events to natural disasters to the pandemic that continues to provide criminal fodder, items that get a lot of news coverage should remind us to be extra careful. Check closely for misspelled URLs or spoofed links. And be wary of clicking on ads.
- Don’t bet. Just kidding. But not really. Sports betting is not currently legal in Georgia. Bills to change that keep going through the General Assembly, but none have passed yet. Sources tell me you can legally bet online in Georgia, but make sure you confirm that and use a reputable site or you’ll be out more than just money.
3. AI-Improved Scams
ChatGPT is everywhere right now, isn’t it? The Artificial Intelligence-powered chatbot has people equally thrilled at the possibilities or hopelessly convinced it will put us all out of our jobs.
Well, here’s another angle on it.
“Cybersecurity researchers from Check Point Research (CPR) have observed the tool being used by cybercriminals to improve – and sometimes build from scratch – dangerous malware and ransomware.
…To make matters even worse, some of the authors seem to be complete newbies to the world of programming, signaling that the tool might be used to dramatically lower the barrier to entry into cybercrime.”
Horrified yet?
Now, don’t get me wrong. I don’t want you to be terrified. Technological advancements are exciting and offer so much promise.
But any tool can be used for good or for bad. I want you to be aware.
I’ve used this monthly email for a long time now to show you examples of scams that work, to give you ways to prevent them from working, and, maybe most importantly, to indicate where they might be heading so you can avoid future scams, too.
Reading about criminals using ChatGPT in these ways tells me their evolution of tactics and messaging could speed up exponentially.
It’s critical that we all build up and share our cybersecurity awareness.
So how can you stay safe from this?
- As I’ve said many times before, it’s not the malicious email, link, or attachment itself that creates the problem. It’s what we, as people, do with it. A scam that gets to its target but doesn’t get opened or clicked on fails. Nothing happens. Crisis averted. It’s our behavior that makes the difference, and we can control our behavior.
- Start with the basics of recognizing red flags and build on that. Check sender names. Check sender email addresses. Pay special attention to unsolicited requests or anything that seems ‘urgent.’
- Trust your gut when something seems suspicious even if you’re not sure why.
- Call or chat or confirm information independently online before taking any action.
- Send any questionable messages to your IT team to check. We have the tools to do this safely and are happy to do so.
- Cybercrime is big business. It makes a lot of money for a lot of people. It’s not going to go away, and we’re not all going to disconnect from our online lives and live in caves. So we need to deal with it. And we can do that by sharing information and helping each other stay safe.
- If you’d like to know whether there’s more you could be doing to protect yourself and your business, give me a call. From security policies to scam simulation programs, there are a variety of options to explore.
