Cyber swindlers masquerading as Australian Cyber Security Centre (ACSC) officials are luring unsuspecting victims to hand over their personal credentials in a malevolent phishing campaign, the agency warned in a new alert.
The scammers are calling and emailing potential victims and trying to get them to download and install malicious software on their computers by claiming that their systems have been compromised, according to the alert. The ACSC classified the ruse as a “medium” level threat.
“Cybercriminals are attempting to take advantage by using the ACSC name to send emails to individuals containing a malicious link requesting they download antivirus software,” the warning reads. Should the target mistakenly click on the link, a download sequence that installs malware to the victim’s computer is launched, officials said.
Could a scenario in which phishers trick users by pretending to work for a national cybersecurity agency play out in the U.S. ? A comparable scheme might be hackers impersonating personnel from the Cybersecurity Infrastructure and Security Agency (CISA) to pull off a malware campaign. Scammers regularly try to trick unsuspecting victims with bogus calls from vendors well known to consumers such as Apple and Microsoft but impersonating a CISA official from an agency likely unknown to computer users would be far less likely to succeed. Still, when it comes to hackers anything is possible anywhere.
In the Australia case, cyber criminals have also telephoned individuals from a spoofed Australian number instructing them to download the TeamViewer or AnyDesk remote desktop software to fix made-up malware issues. Once the duped target has done so, the fraudster then asks them to enter a corrupt URL into their browser and access their online banking services resulting in confidential information handed over to the hacker.
Australians who have been targeted in this campaign or want to find more about these ongoing attacks are advised to reach out to the ACSC by calling 1300 292 371 (1300 CYBER 1).
The ACSC issued steps users targeted in cyber phishing expeditions can take to protect themselves from malware scams:
- If you've received one of these calls but have not engaged with the scammer, you can report it to Scamwatch.
- If the cybercriminal has accessed your device via Team Viewer, Zoho Assist or AnyDesk, you should report it to ReportCyber and immediately notify your bank. Your financial institution may be able to put a temporary freeze on your financial accounts.
- To prevent further compromise, you should also change passwords on all your important online accounts including banking, email and social media, and turn on two-factor authentication for extra security.
