Another case of phishing attacks has come to light, and this time it targets Stripe users , with the aim of stealing not only users' account credentials , but also their banking information .
Researchers at Cofense discovered the attack targeting users of Stripe, a company that provides online payment processing. According to the researchers, the phishing attack not only aims to steal credentials , but also to trick them into sharing their financial information.
First, the attackers send users emails that appear to come from Stripe, informing them that their account details are invalid. The malicious actors have taken care to design this message quite cleverly, as they misrepresent the sender’s identity as “Stripe Support.” They have also replaced the “Review your details” button that users can click on in the email with an HTML title tag. This prevents the user from seeing a preview of the embedded link.
Clicking the “Review” button, the user is taken to a malicious website that includes a series of pages. The first page asks for credentials, which then leads to another page, asking for the user's bank account number and phone number. The final page redirects the victim to the real Stripe website to avoid possible detection.
Always be cautious
While most phishing campaigns target users via email, the technique is not limited to emails. Criminals use various tricks in social media as well.
To avoid such attacks, users should be cautious of all messages they receive that ask them to enter any information. It is possible that an incoming email is part of a phishing attack, unless it is a response you are actually expecting from a company. For example, the verification/login message you receive when resetting your password on any online account.
Simply put, whenever you receive an email notifying you of a suspicious/failed login attempt, account expiration/verification/authentication, or any other issue, try to confirm the source stated in the email in another way. For example, you can call your bank to verify if the message you received is from them, or contact the company's customer support, such as Microsoft or Instagram, to validate the message. If you are unsure about the authenticity of an email, it is best to avoid responding.
