Beware Of More Personal Phishing Campaign Under The Guise Of Email From HRD

An example of an email from a fake HRD (photo: Kaspersky)

JAKARTA - Kaspersky has identified an advanced phishing campaign targeting employees with personal emails and attached documents disguised as HRD policy updates.

More worryingly, attackers not only adjust their email content, but also their attachments by targeting each recipient, showing an unprecedented level of customization.

"This campaign shows a new level of sophistication in phishing attacks, and we will probably see a mechanism for automation of new letter shipments that produce attached documents and separate images for email bodies for each recipient," said Roman Dedenok, Anti-Spam Expert at Kaspersky.

The attackers may be preparing themselves by unraveling the names of employees so that the campaign is targeted and more convincing. The goal is to lure victims into entering their company's email credentials.

The emails display deceptive content such as: fake "verified sender" icons, and invitations to open attached files to review remote work protocols, allowance administration, and security standards.

However, if the victim scans the QR code and follows the link, they will be directed to a fake page asking them to enter the Company's credentials.

"Organization must prioritize advanced security measures and employee education to remain at the forefront of facing this threat," he concluded.

To stay safe, Kaspersky recommends: