Your Voicemail Has a Message… and It Wants Your Password

Voicemail notifications are about as exciting as watching the microwave count down. You see the message, click to listen or read the transcript, and move on. Unfortunately, cybercriminals are now counting on that routine behavior.

Check Point Research recently uncovered a large-scale phishing campaign that uses fake voicemail-transcript emails to trick people into handing over their login credentials. Researchers identified more than 58,000 emails targeting more than 7,800 organizations. The campaign used more than 38,400 spoofed sender addresses across more than 9,300 spoofed domains. 

2

The emails are designed to look like ordinary automated voicemail notifications. Nothing about that sounds particularly suspicious. After all, businesses routinely send notifications about missed calls and voicemails.

Here’s the catch.

Advertisement

Instead of simply providing a transcript, the messages contain a malicious SVG attachment. SVG files are normally associated with images, but in this case they are being used to redirect victims to a fake login page designed to steal usernames and passwords. Once again, this is evidence that any file type can be used in phishing.

And that’s what makes this scam particularly sneaky. The criminals aren’t necessarily asking you to open a strange attachment promising a million dollars or claiming your computer has a virus. They’re taking something completely ordinary and turning it into a trap.

2

Treat unexpected voicemail notifications with a little suspicion, particularly if you’re asked to open an attachment or sign in to an account.

If you weren’t expecting the message, don’t use the link or attachment to access your voicemail. Instead, open your normal email, phone, or communications app directly and check for the message there.

And remember: familiar doesn’t always mean safe. Phishing works best when it looks like something we’ve seen a hundred times before.