Monzo customers bombarded with phishing attacks
Shady SMS messages targeting Monzo customers are making the rounds
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Millions of Monzo users are being targeted by a phishing attack looking to obtain victimpasswordsand other login credentials and take over their digital identities.
Monzo is one of the UK’s largest cloud banks, offering a fully online banking platform, and Mastercard debit cards, among others.
The company took to Twitter to notify users of the phishing campaign going around, and to help them stay safe. In aTwitter thread, it explained that an unknown threat actor is sending out SMS messages to Monzo users, in which they are asked to reactivate their session, or verify their account, by tapping on the link provided in the message.
We’re looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn’t take more than 60 seconds of your time. Thank you for taking part.
Click here to start the survey in a new window«
On theendpointsmartphone, the sender’s name is shown as MONZO, but the links, as it’s standard practice with phishing attacks, don’t lead to Monzo’s official website, but rather a fake landing page created to steal user credentials.
So far, the following domains have been uncovered:
Stealing identities
Should a gullible user click on any of these links, they’d be greeted with a landing page unlike Monzo’s official website, and an option to add their full name, phone number, and the Monzo PIN - basically everything an attacker would need to steal their identity and gain full access to their account.
Monzo wasn’t the only one investigating the issue, too. As reported byBleepingComputer, security researcher William Thomas was also looking into the matter, and found four more domains on the same ASN, this time targeting Revolut users:
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
What is phishing and how dangerous is it?>LinkedIn is becoming a paradise for phishing attacks>How to shut down a phishing operation in 48 hours
“Research into the domain itself via URLscan.io uncovered 33 other identical sites, dating back to 11 November 2021,” Thomas explained.
“All 34 domains were hosted on the same three CIDRs in Russian IP space with NForce Entertainment (AS43350). Interestingly, the Monzo-themed domains also used two Guangdong-based Registrars (Eranet and NiceNic).”
Mixing Chinese registrars and Russian IP addresses, BleepingComputer concludes, makes it hard to attribute the attack to a specific group, and even harder to take the campaign down. As usual, users are advised not to click on any links, or download any attachments, before verifying theidentityof the sender.
Via:BleepingComputer
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
LG Electronics sets ambitious B2B revenue goal to offset declining consumer demand
