14 DAY TRIAL // Cybercriminals are trying to trick Hotmail users into handing over their credentials with fake emails that purport to come from “The Microsoft account team.”
The emails, analyzed by researchers from Malwarebytes, inform recipients that their Hotmail account service has expired and that they have to sign in to reactivate it.
“Dear User, All Hotmail customers have been upgraded to Outlook.com. Your Hotmail Account services has expired. Due to our new system upgrade to Outlook. In order for it to remain active follow the link Sign in Re-activate your account to Outlook. account.live.com,” the scammy emails read.
The link from the bogus notification points to a phishing website that replicates the Outlook.com login page. The phishing site spotted by Malwarebytes is hosted on a compromised Sake website whose owners are probably not aware of the fact that they’ve been hacked.
The spam sample analyzed by experts contains an error. The link doesn’t point where it’s supposed to because the URL is broken. However, Internet users should be careful because the cybercriminals that run the campaign will probably correct the problem in no time.
In order to avoid falling victim to such phishing attacks, be careful when you come across suspicious emails. If their body contains typos or grammar errors, or links that point to suspicious domains, they might be part of a cybercriminal scheme.
Also, if a notification contains a ZIP attachment, it’s probably part of a malware distribution campaign.
Phishing websites can be identified easily by looking at the URL in the web browser’s address bar. In this case, if it’s anything else than outlook.com, it’s probably a scam.
Also, the websites of major companies such as Microsoft are usually protected by an HTTPS connection (the left part of the address bar is green and there’s a padlock icon to indicate the presence of an SSL certificate).
If you’re a victim of a phishing attack, the first thing you must do is change your password. In case you’ve been using the same password for multiple accounts, change all of them, since the cybercriminals will likely try to access your other accounts as well.
Make sure that the new passwords are different for each site, and also ensure that they’re not easy to guess. If you’re having problems remembering complex passwords, use a password manager.
Password managers can generate impossible-to-crack passwords that you don’t have to remember. You only have one master password that allows you access to all the others.