Protecting over 200 million PCs, Macs, & Mobiles – more than any other antivirus

Archive

Posts Tagged ‘phishing’
July 31st, 2014

Security basics: Internet scams and your identity

If you’re afraid “to do something wrong” when you sit behind your computer, this new series is for you.

AVAST has expertise in developing security products and we want to bring you a complete series about internet danger, with good practices to avoid scams, loss of money, and identity theft. You’re just about to join a tutorial that will help you avoid such threats in the virtual world.

Privacy July 2014 B (2)

First, being afraid to do something wrong is healthy because it will slow you down, which can be a good thing since most mistakes are made due to rushing through something. Computers, smartphones and tablets are advanced tech devices. Those of us who did not have the opportunity to learn and gather knowledge and experience on using these devices when we were young, can be a little shy with them. Searching for information about how to do something with your device is not always easy because people tend to use complicated language. Making it simple and easy-to-understand is a task that we assume with pleasure.

The Basics

The internet is a space for sharing and dialog. However, alongside this encouraging environment you will face some areas where you need to exercise caution: Inappropriate content for children like adult sites; sites which promote hateful content such as racism and intolerance; and cybercriminals who use different methods to steal your personal, banking, and credit card data.

You may be tempted to think that no one will be interested in your computer, or that your computer cannot be found in the internet jungle. That would be a mistake.

Cybercriminals hide in the jungle and misuse your computer as a base to attack others, and spread viruses (malware) or spam. Think of it this way – the banking systems and e-commerce sites have, in general, a much bigger and more sophisticated security arsenal than your own computer (smartphone or tablet), and yours is the weakest point in this chain.

So let’s start from the same place.

Here’s The Rule: All safety measures you take in real life should be applied when you use the internet: Visit only trustworthy sites and stores, do not share your personal data with anyone, lock the doors, and put an alarm. AVAST believes security implies prevention: Be prepared before something bad surprises you.

Your identity is up for grabs

Your personal data or your credentials for a particular site (username and password) are quite valuable to cybercrooks. With this data, scammers act on your behalf; sending emails (like the phishing ones we’ve written about lately), shopping with your credit card, and doing things that can cause harm to you, not only financially but also for your reputation. They could share false information about you, photos and personal data. This could led to problems when, for instance, you are looking for a new job, but also in your personal and family life.

Create strong passwords to protect your online accountsTaking care of your passwords is essential. Use different passwords for each service or internet site. You should create the so-called strong passwords: CAPS letters, symbols, and numbers. AVAST offers an automated solution for your passwords called avast! EasyPass. This way, using different and secure passwords, cybercriminals can’t easy guess your credentials, enter in sites, or shop in your behalf.

Do not answer unsolicited emails or sales promotions that promise you a financial return after you make a small payment. Never help or join into the financial operations of a third party, close to you or not. Do not trust in NGOs that ask for donations, rather look for the official sites to contribute. Never giveaway your banking data for “personal credit and rewards” announcements, for example, bogus companies offering jobs that ask for a preliminary payment. Scams that prey on your emotions are prevalent. Dating scams in-the-wild ask for money to make a trip to meet your  love interest personally. In fact, after you pay, you’ll never see your love again. Beware of these types of scenarios.

How can we avoid these scams? Generally, they ask for a quick and secret decision and, often they have spelling and grammar errors because many still originate from foreign locales and rely on online translation software to spread the scams all over the world.

Thank you for using avast! Antivirus and recommending us to your friends and family. For all the latest news, fun and contest information, please follow us on Facebook, Twitter, Google+ and Instagram. Business owners – check out our business products.

July 28th, 2014

Phishing scam steals Finnish bank passwords, earns big money

Earlier this month, we told you about a spear phishing campaign specifically targeting banking customers in Czech Republic, and now a similar scam is targeting bank customers in Finland.

Finnish banks warn their customers of phishing scheme.

Finnish banks warn their customers of phishing scheme.

This weekend, Aktia, Nordea, and Nooa Säästöpankki customers received text messages and emails informing them that their online banking services were being discontinued because of a payment in default. The message said the payment had to be made immediately to avoid this. The victims were then instructed to follow a link in the email where they could enter their ID and bank access codes including PIN. The victim was promised that a representative of online banking services would call to confirm after the payment was received.

So far, 500,000 euros has been stolen. Of course, there is no default payment and the whole thing is a hoax to earn cybercriminals money. Within the last month, 95 percent of the victims have been women, said Detective Superintendent Jukkapekka Risu from Helsinki Police to the Helsinki Times.

What you need to know to protect yourself

Do not click on links, download files, or open attachments in emails from unknown senders. Phishing websites often copy legitimate websites so they appear authentic. To be safe, call the bank to find out if they really sent that email to you.

Do not call the number in the email. It can easily be faked. Look up the real number of your bank and call using that.

Banks will not ask for customer names or IDs by email, text message, or phone. If you have fallen victim to the scam message and have volunteered information, please contact your bank immediately.

Protect your computer with a firewall, spam filters, antivirus and anti-spyware software. Both avast! Internet Security and avast! Premier have these important features. SafeZone is an additional security feature in avast! Pro Antivirus, avast! Internet Security and avast! Premier, which allows you to browse the web in a private, secure environment, invisible to the rest of your system. For example, if you do your banking online, you can be sure that your personal data cannot be monitored by spyware or key-logging software.

Thank you for using avast! Antivirus and recommending us to your friends and family. For all the latest news, fun and contest information, please follow us on Facebook, Twitter, Google+ and Instagram. Business owners – check out our business products.

 

July 18th, 2014

Spearphishing scams hope you’ll take the bait

avast! Internet Security protects you from phishing and email scamsYesterday on our blog, avast! Virus Lab researcher Jaromir Horejsi, explained a banking Trojan called Tinba. The cybercrooks behind Tinba use a social engineering technique called spearfishing to target its victims.

You have probably heard about email scams that use phishing. This classic technique uses authentic-looking emails to lure the victims to fake websites, then trick them into revealing personal information. Also this week, we told you about an email that AVAST evangelist, Bob G. received claiming that he won money in a World Cup lottery. The cybercrooks behind that scam cast a wide net, hoping to catch a few people then ask them to provide banking information so they could deliver the prize.

Other high profile phishing attempts, like the DHL email scam that ran last Christmas, preyed on the anxiety of the holidays. An email that looks like the real thing was sent, offering all sorts of urgent and legitimate-sounding explanations as to why they need your personal data. It’s not hard to understand why busy people can be fooled.

Spearphishing is similar in every way except that the net is drawn in much tighter. The FBI says that cybercrooks target select groups of people with something in common—they work at the same company, bank at the same financial institution, attend the same college, order merchandise from the same website, etc. The emails are seemingly sent from organizations or individuals the potential victims would normally get emails from, making them even more deceptive. This is what is happening with the Tinba Trojan right now in Czech Republic.

In both social engineering schemes, once the victim clicks, they are led to a phony but realistic-looking website, where they are asked to provide passwords, account numbers, user IDs, access codes, PINs, etc.

How to avoid becoming a spear phishing victim

  • Most companies, banks, agencies, etc., don’t request personal information via e-mail.
  • If in doubt, give them a call (but don’t use the phone number contained in the e-mail—that’s usually phony as well).
  • Use a phishing filter. Both avast! Internet Security and avast! Premier include anti-spam filters to detect phishing and scam emails.
  • Never follow a link to a secure site from an email; always enter the URL manually.

Thank you for using avast! Antivirus and recommending us to your friends and family. For all the latest news, fun and contest information, please follow us on FacebookTwitter and Google+. Business owners – check out our business products.

December 12th, 2013

Christmas time! Do you want a malware present?

DHLspoofChristmas time is essentially connected with buying presents. There’s a lot of stuff to be done and a lot of opportunities to buy a present in an e-shop to save time. Who doesn’t know someone who buys a Christmas gift online?

The malware authors know and are very keen to take advantage of it. We see scam emails containing order or delivery details every day and they have a lot of common. In fact, it’s nothing new. Such methods are used constantly during the year, it’s nothing special connected to Christmas. However, Christmas is the reason why many people might be fooled. Let’s look at them in detail.

Imagine you are customer waiting for a present to be delivered. You get anxious and check your email waiting for order details. You are probably the most vulnerable at this time. Then you get an email from DHL, the well-known parcel delivery service, with a notice saying that the shipping details are in an attachment. In that moment of relief, you click on the email attachment. It turns out to be a zip file containing a file named DHL-parcel.exe. The strange thing is the file extension looks like regular PDF file because it has the same icon. In fact, it is malware.

Read more…

Comments off
October 30th, 2013

Halloween tricks move online

HalloweenBack in the good ol’ days of Halloween, you only had to worry about your house getting egged or your big brother stealing the good candy. Halloween tricks have moved online, and along with any significant event or holiday, this spooky celebration marks an increase in malware. Cyber ghouls pull out their bag of tricks – rogue apps, scams, and email attachments, to name a few classics – all to get unsuspecting people to click on a link in order to steal credentials.

Here are a few tricks to be aware of:

Bad video links and rogue apps

In the weeks before Halloween, searches for holiday-related items like costumes and pumpkin carving increase. This example of a search for “Halloween costume make your own” came from Glen Newton of Wired’s Innovation Insights. He wrote,

The website that came up at the top of the list has a link to a video that promises to show you how to make one for under $15 in materials, requiring only basic sewing skills – just what you were looking for. You click, and there it is, but the video doesn’t play. Oh, wait, there’s a note at the bottom of the player that says, “If this video doesn’t start playing, click here to download the latest flash player.” You click.

You can guess what happens next. No, someone in a Ghostface is not looking in your window. Rather, when you click to download, a warning pops up that your PC is infected with multiple instances of malware. But don’t you already have virus protection? You immediately assume that it’s not working, plus you remember that you haven’t backed up your files in months (cue the Psycho music). Panic ensues.

The scan window…show(s) you third-party software that can remove the malware… Fortunately, it’s not a budget breaker: $39.95 for a year’s license. The web page includes graphics that show several certifications with which you’re unfamiliar, so you figure it must be safe.

Instead of finding out how to make a costume, you end up selling your soul to the devil. Well, not quite that bad – but you give personal information and your credit card number to buy a malware removal program. After the purchase is made, you still can’t access the video. Meanwhile, the personal information and credit card data you gave away is being sold to the highest bidder on underground crime webs, and your real antivirus has been disabled and replaced by malware that the crooks can use to control your computer. Talk about a Nightmare on Elm Street…

Read the whole article from Wired.

AVAST Tip: Only visit websites that are established and reputable, and keep your antivirus software updated. (And remember, vampires can only enter your house if you invite them!)

 

Recycled scams

voodoo dollSome old-fashioned tricks that have made the jump from darkened parlors to cyberspace are virtual voodoo dolls, fortune-telling, psychic readings, and spell casting. There are good and respectable “intuitive consultants” (as some psychics prefer to be called) that are able to help others. For every good one, there are a plenty who con people to only get their money.

A typical M.O. of scammers is to use multiple sites with similar content. So if you see a site for Voodoo Queen Mumbo Gumbo who is offering a buy one spell, get one free, and you see 12 others with similar content, then forget about it.

“It’s a new twist on an old idea,” said Nicholas Little, legal director of the Center for Inquiry to the Toronto Sun yesterday. “It’s easy to hide your identity on the Internet, so people are willing to try scams online that they would never be willing to try in person.”

AVAST Tip: Never pay for a service or product that you are not sure of or you do not want. (A money-back guarantee for spell casting is not a good sign!)

Read more…

Comments off
June 6th, 2013

Facebook virus empties bank accounts

ZeuS Trojan

A dangerous Trojan named ZeuS is making its way among Facebook users. This old Trojan horse has infected millions of computers over the years, stealing banking credentials and other personally identifiable information. Zeus can lie dormant on infected computers until the unsuspecting victim logs into their bank’s website. Once you’re logged in, cybercrooks can steal your log in credentials and empty your account without your knowledge.

The virus is spread through phishing messages either from a funny or shocking video from a friend posted on their page or in a message to you, or through an ad for videos or products. If you click the link to watch the video, a notification will say that you need to update the player. When you click update, you are actually downloading the Trojan. Clicking the Play button automatically gives your “Like” to the virus page, and it’s through this action that the link will spread to all of your friends.

All avast! Antivirus products detect and block Zeus if a user tries to install or run the .exe file, but the best way to protect yourself is to avoid it! avast! SafeZone is recommended for safe banking, financial transactions, and shopping online. It gives you a private, secure, and isolated desktop which keeps you safe from keyloggers like the ZeuS Trojan. avast! SafeZone is available in avast! Pro, avast! Internet Security, and avast! Premier.

 

Please share this with your family and friends.

Thank you for using avast! Antivirus and recommending us to your friends and family. For all the latest news, fun, and contest information, please follow us on FacebookTwitter,  Google+ and Instagram.

March 25th, 2013

Fake Facebook login pages spreading by Facebook applications

Another wave of Facebook phishing is spreading among Facebook users. Imagine you get a message from another Facebook user with a link to a new amazing Facebook app. Even if the sender is not your friend, you decide to go to the link. Instead of an application you see a fake Facebook login page. But here’s the catch – you don’t know it’s a fake!

Recently we have encountered a lot of Facebook apps which do nothing but redirect users to a fake Facebook login page. You cannot recognize from the link that the application has no real content. The URL of the application looks like http://apps.facebook.com/app_id where app_id is 15-digit identification number of the application. The application link usually contains its name (http://apps.facebook.com/app_name), but using the application ID in the link is also possible.

Read more…

Comments off
February 4th, 2013

Tax scams to watch out for: Phishing and identity theft

tax_imgIt’s that time of year again for Americans. You have received your W-2 and are eager to file your tax return, especially if you anticipate a refund. Every year, the Internal Revenue Service (IRS) warns taxpayers to beware of phishing scams used by con artists to steal your identity, cash, and sense of security. This year is no different.

Phishing takes many forms, but usually involves unsolicited email or messages via social media and a fake website that poses as a legitimate site. The danger is that if you follow the link the scammers provide, you could end up with a malware infection, such as a Trojan that logs your keystrokes and allows a hacker to gain access to your bank accounts, or you could provide valuable personal and financial information that exposes you to identity theft. Here are some recent examples:

Classic phish: Last tax season, a bogus email warned recipients they would be penalized up to $10,000 for not filing their taxes by a false deadline of January 31st. They were instructed to follow a link which went to a phony site that appeared to be the official IRS website. They were asked to provide personal or financial information that could be used by scammers and identity thieves.

Don’t be misled by sites claiming to be the IRS but ending in .com, .net, .org or other designations instead of .gov. Read more…

October 29th, 2012

High potential for Hurricane Sandy internet scams

http://www.weather.com

With Hurricane Sandy bearing down on the northeast United States, the potential is high for cybercrooks to release a wave of scams and malware related to the storm. If the past repeats itself, Facebook postings, tweets, emails, and websites claiming to have exclusive video or pleading for donations for disaster relief efforts will appear shortly after the storm hits. These messages often include malicious code that attempt to infect computers with viruses, spyware, or Trojan horses.

After hurricanes Katrina and Rita hit the Gulf Coast in 2005, the FBI, the Justice Department, and the Federal Trade Commission formed the Hurricane Katrina Fraud Task Force to battle the massive surge of scams that came with it. The American Red Cross reported at least 15 fake websites that were designed to look like legitimate Red Cross appeals for donations to relief efforts. These actually proved to be phishing attacks,  which directed users to a malicious server that collected credit card numbers, PayPal passwords and other personal information.

When donating, make sure you donate directly to reputable charitable organizations. Ask for a physical address and a phone number of the charity – if the charity is authentic, they will willingly give you this information. As always, do not respond to an unsolicited email of any sort.

Comments off
August 29th, 2012

avast! detects Facebook photo tagging malware

Photo and related article from http://mashable.com/2012/08/28/facebook-malware-photo-tag/

Have you received an email saying a friend tagged you in a photo on Facebook? Use extreme caution before clicking to see photos in the attachment. In a typical phish, cybercrooks are using a fake Facebook photo notification email designed to spread malware allowing them to gain control over Windows-based computers.

Avast Virus Lab detected the malware as Win32:Trojan-gen and added the definition to the database yesterday, so all avast! users are protected.

The email looks innocent enough with the familiar blue header and logo. Serious Facebookers may know that Facebook never sends you photos that you’ve been tagged in as attachments; rather they send links to the photos. Unfortunately, most of us are too busy to notice the difference.

Please share this warning with your Facebook friends, and recommend that they get avast! Free Antivirus, so they’ll always be protected. You can share avast! by clicking on our recommend avast! app here.

 

 

Comments off