Hackers target national portal of India via 'unprecedented' phishing technique

Bengaluru, Jul 7 (IANS): Cyber-security researchers on Thursday said they have discovered an "unprecedented, sophisticated" phishing technique that has been targeting government websites across the world, including Indian government's portal https://india.gov.in, extorting the affected users.

The threat actors have been targeting the Indian government's portal by utilising a bogus URL to trick users into submitting sensitive information such as credit card numbers, expiration months and CVV codes, according to AI-driven cyber-security firm CloudSEK.

Hackers are imitating the browser window of the Indian government website, most often SSO (single sign-on) pages, with a unique login, in a most-advanced phishing technique commonly known as Browser-in-the-Browser (BitB) attack.

BitB attacks imitate legitimate sites in order to steal user credentials as well as other sensitive data, such as personally identifiable information (PII).

The new URL that pops-up as a result of the BitB attack appears legitimate.

"The bad actors have also replicated the original page's user interface. Once their victims click into the phishing page, a pop-up appears on the phoney window claiming that their systems have been blocked, posing as a notification from the Home Affairs Enforcement and Police," the researchers claimed.

The users are then notified of their excessive use of pornographic websites, which is illegal under the Indian law, and are requested to pay a fine of Rs 30,000 to unlock their systems.

"They are given a form to fill out in order to pay the fine, which asks them to divulge personal information, including their credit card information. The victims become panicked because the warning has a sense of urgency and appears to be time-bound," the researchers said.

The information that the victims enter into the form is transferred to the attacker's server.

Once the attackers get the card information, it might be sold to other buyers in a larger network of cyber criminals, or the victim could be extorted for extra money.

The BitB attack begins when users attempt to connect to a website and click on a malicious link that looks to them as an SSO login pop-up window.

When users visit the supplied link, they are prompted to log in to the website using their SSO credentials. After there, the victims are sent to a bogus website that looks exactly like the SSO page.

The attack usually stimulates single sign-on windows and displays fake websites that cannot be distinguished from the original page.

"Combine SSO with MFA (multi-factor authentication) for secure login across accounts, check for suspicious logins and account takeovers and avoid clicking on email links from unknown sources," the researchers suggested.



Top Stories

Leave a Comment

Title: Hackers target national portal of India via 'unprecedented' phishing technique

You have 2000 characters left.


Please write your correct name and email address. Kindly do not post any personal, abusive, defamatory, infringing, obscene, indecent, discriminatory or unlawful or similar comments. Daijiworld.com will not be responsible for any defamatory message posted under this article.

Please note that sending false messages to insult, defame, intimidate, mislead or deceive people or to intentionally cause public disorder is punishable under law. It is obligatory on Daijiworld to provide the IP address and other details of senders of such comments, to the authority concerned upon request.

Hence, sending offensive comments using daijiworld will be purely at your own risk, and in no way will Daijiworld.com be held responsible.