You can confirm the real identity of an email's sender (in Gmail, click the downward-facing arrow next to your name). You have a relatively small number of actors who create phishing kits-the collection of files needed to create a phishing page-who then distribute them through social media, underground forums, or their own vendor webpages.'Īs in any phishing scheme, there are a few simple ways to keep yourself safe. 'That's essentially how the phishing ecosystem works. 'It's likely a bunch of phishers using a single phishing kit that was created and distributed by a single actor,' Hassold says. The App Store scam is also indicative of other phishing trends, particularly in terms of how it has propagated. Click on any of them, and you're sent to a site that mimics Apple's actual account management page, prompting you to enter your username and password. There's no malware in the file itself, but the somewhat convincing PDF contains several links with shortened URLs. If your first thought is that opening that attachment is a no-good, terrible idea, you are correct! But maybe not for the reasons you suspect.

Specifically, it claims to be a purchase confirmation from Apple, with a PDF attached posing as a receipt. Like so many phishing efforts, it starts with an email purporting to be something that it's not. This month, it's a bogus Apple App Store email that convinces its victims to cough up all kinds of personal information.įirst reported by Bleeping Computer, the phishing campaign doesn't contain any especially novel elements, but it executes the basics well enough that it's easy to be fooled. Last year it was a phony Google Docs link and a convincing Netflix impersonator, both of which had plagued the internet sporadically for months, at least, before seeing big surges.

Appstore com