XSolutions Sees Uptick In Owner/CEO-Spoofed Emails

This is very important so please make sure that EVERYONE in your organization knows about this.

Over the last few weeks, we have seen a number of phishing emails impersonating the owner or CEO that are being sent to accounting and HR personnel instructing them to send money, purchase payment cards, etc.

In one case, the “CEO” requested thousands of dollars in iTune cards supposedly for gifts; in another instance, an employee was asked to send a payment.

Each email appears to be different, tailored to the target company. That means that hackers are doing their research—and size doesn’t matter. Large and small firms are getting phished.

It appears that, in some cases, the scammers know that the boss is out of the office. Social Engineers are very resourceful when it comes to finding information like this. They could have gotten this information from previous phone calls to the target company, stolen emails, social media, etc.

If an employee receives such an email “from the owner or CEO” it is imperative that they don’t take any action until the request is verified. A simple phone call to the boss will stop this scam and avoid financial loss.

Here’s a real phishing email recieved by one of our clients (identifying information has been redacted):

Looking at the above example, Outlook showed the real email address of this sender. It was clearly not from the boss. In this case, it was blatenly different, however, scammers will register domain names that closely resemble those of target companies—so always scrutinize them carefully.

By the way, most email clients will show the real address if you hover your mouse over the displayed email address. See above screenshot.

Make sure everyone in your organization is aware of the scam—accounting and HR staff have been the focus of recent attacks.

XSolutions is an Elite Partner of Datto, the world leader in Hybrid-Cloud Business Continuity solutions whose systems protect 300+ Petabytes of data with over 800 employees and 9 offices around the globe. Call (845) 362-9675 and let us introduce you to the ultimate defense against data loss—whatever the cause.