Cyber attackers are deploying phishing attack for luring victims into revealing their sensitive information through fraudulent websites that they control.
Instagram users are being targeted with fake login attempt warnings and two-factor authentication codes to make the phishing attack appear more believable.
Cyber attackers deploy phishing attacks to lure victims into revealing their sensitive information through fraudulent websites they control. This is done through social engineering techniques and messages that appear to come from a legitimate authority.
Attackers send phishing emails that appear to be fake Instagram login alerts. These alerts trick victims into believing someone has tried to log in to their account. Attackers then ask victims to confirm their identity through a fake sign-in page linked in the message.
The fake page also includes a code presented as a second authentication code to confirm identity. Once the victim lands on the phishing page, they see a perfectly cloned Instagram login page. This page carries a valid HTTPS certificate and displays a green padlock, so the victim has no reason to doubt its authenticity.
The emails used in this Instagram phishing attack look identical to Instagram’s official messages. They appear legitimate and do not raise obvious alarm bells, apart from a few punctuation errors and a missing space before the word “Please.”
The key loophole is in the browser’s address bar. Instead of showing instagram.com, the attackers use a .CF domain. That detail alone can save you from falling victim.
This is not the first time Instagram users have been put at risk. In May 2019, news surfaced about an unsecured Instagram database found publicly exposed on the internet.
The leak came from an unprotected database hosted on an Amazon Web Services bucket. It exposed over 49 million records of Instagram influencers, including brands, celebrities, and food bloggers.
If your Instagram credentials are stolen or your account is hacked, and you still have access, start by checking whether your actual email address and phone number are still linked to the account.
Go to your profile, select Edit Profile, and scroll to the bottom to check your email address and phone number. If your details have been swapped with those of an attacker, enter your correct information right away.
Change your password by following Instagram’s instructions. This will automatically log out all devices currently signed in to your account, then let you log back in securely.
Here are a few more steps that help with phishing attack prevention:
Staying alert while using the internet is the first step in preventing phishing attacks.
No. A green padlock only means the connection is encrypted. It does not confirm that the site is legitimate. Attackers can get free SSL certificates to display the padlock on fake pages. Always check the full domain in the address bar.
You are likely safe, but do not ignore it. Avoid entering any credentials on the page you landed on. Scan your device for malware, since some phishing pages attempt to run scripts in the background. Monitor your account activity closely over the next few days
Web hosting provider company Hostinger suffers from a massive cyber breach. This attack has forced the company to reset...
Cyber Threat Report of 2019: 69% of Firms Face Serious Cyber Attacks in India! Do you know that India...
Information Security Group’s Checklist: Top 4 Cybersecurity Practices Here are the top 4 cybersecurity practices that...