‘Monster’ phishing of recruitment website

gallery

A new phishing scam targeting users of the recruitment website Monster.com has been discovered by researchers at McAfee.

It is part of a trend by criminals to target recruitment websites, which like social networks, contain personal and sensitive data carried in carried in CV’s and databases.

Monster.com has been targeted by criminals before – last year it was victim of two security breaches caused by a trojan attack, which resulted in the details of 1.3 million US job seekers being exposed.

The latest attack works by sending potential victims emails which ask users to click through and update their profile, but is traced back to a bot in Turkey.

McAfee said that the scammers were trying to get through to recruiter’s accounts and gain access to CVs which can sometimes hold valuable information.

Like the recent trend for scammers targeting social networks, McAfee security analyst Greg Day felt that criminals were taking advantage of the current economic climate, with users increasingly using the internet to find new jobs to see what is available.

He said: “The repercussions of this are potentially huge. If a cyber criminal is able to access a large number of CVs, the information obtained could easily be used for malicious intent.

“As far as cyber criminals are concerned, CVs offer a goldmine of information, so this would be a major result for them.”

A RSA ‘Online Fraud Report’ was also released which said that collecting the data given by victims through phishing attacks was being made much easier thanks to new phishing kits that are designed to directly store data in a MySQL database on a phishing server.

Previously the stolen information would have been sent as text to the fraudster’s email address coded within PHP files, or simply stored on the server as a text file.

Email to a friend

Print this page