Cyber-security researchers on Thursday said they have discovered an "unprecedented, sophisticated" phishing technique that has been targeting government websites across the world, including the Indian government's portal https://india.gov.in, extorting the affected users.
The threat actors have been targeting the Indian government's portal by utilising a bogus URL to trick users into submitting sensitive information such as credit card numbers, expiration months and CVV codes, according to AI-driven cyber-security firm CloudSEK.
Hackers are imitating the browser window of the Indian government website, most often SSO (single sign-on) pages, with a unique login, in a most-advanced phishing technique commonly known as Browser-in-the-Browser (BitB) attack.
BitB attacks imitate legitimate sites in order to steal user credentials as well as other sensitive data, such as personally identifiable information (PII).
The new URL that pops-up as a result of the BitB attack appears legitimate.
"The bad actors have also replicated the original page's user interface. Once their victims click into the phishing page, a pop-up appears on the phoney window claiming that their systems have been blocked, posing as a notification from the Home Affairs Enforcement and Police," the researchers claimed.
The users are then notified of their excessive use of pornographic websites, which is illegal under the Indian law, and are requested to pay a fine of Rs 30,000 to unlock their systems.
"They are given a form to fill out in order to pay the fine, which asks them to divulge personal information, including their credit card information. The victims become panicked because the warning has a sense of urgency and appears to be time-bound," the researchers said.
The information that the victims enter into the form is transferred to the attacker's server.
Once the attackers get the card information, it might be sold to other buyers in a larger network of cyber criminals, or the victim could be extorted for extra money.
The BitB attack begins when users attempt to connect to a website and click on a malicious link that looks to them as an SSO login pop-up window.
When users visit the supplied link, they are prompted to log in to the website using their SSO credentials. After there, the victims are sent to a bogus website that looks exactly like the SSO page.
The attack usually stimulates single sign-on windows and displays fake websites that cannot be distinguished from the original page.
"Combine SSO with MFA (multi-factor authentication) for secure login across accounts, check for suspicious logins and account takeovers and avoid clicking on email links from unknown sources," the researchers suggested.
