Thomas Cook phishing sites skyrocket following firm's collapse

Former employees and customers are believed to be the targets of malicious campaigns capitalising on the company's liquidation

Phishing

Security researchers have detected 53 Thomas Cook-related domains having been registered in the week after the travel operator went into receivership, a sharp rise from the norm.

Skurio's researchers issued an alert to former employees and customers of Thomas Cook calling for greater vigilance when visiting online services claiming to be associated with the fallen travel company.

The researchers told reporters at a media event that some of the domains were registered with good or harmless intent, but it seemed as though a minority were created for phishing purposes.

Patrick Martin, head of threat intelligence at Skurio said as of 1 October, as far as he could see, none of the sites were actively hosting malware, "but there's 53 domains out there so I'd be surprised if at least one or more [wasn't]".

"With the majority of the ones I looked up, malware wasn't the game, it was more about harvesting user data," added analyst John Evans. Below is a screenshot of one of the new sites and the form it asks users to complete.

Martin added that roughly 25% of the domains were simply piggybacking off the collapse and used as harmless redirects to other sites one redirected to a UK license plate website.

Others were simply using the domain to get clicks on adverts, according to Evans. "There were quite a few I bumped into though that were just capitalising on ad revenue. There was one that was like, how to help Thomas Cook holidaymakers, so if you want to book a new holiday or find jobs for Thomas Cook employees all it's doing is, when you click on it, it takes you straight to Expedia, or wherever."

"One of them is German, it was a .de domain which took you to a German page," said Martin. "It was just two lawyers talking about Thomas Cook and their subsidiaries." The site pretends to be a legitimate business using the Thomas Cook likeness to make money from customer refund claims.

Around 50% of the domains had holding pages, like stock home pages, given to websites using platforms such as Wix or WordPress as they waited for the full site to go live.

The small remaining portion had no landing page at all which, according to the researchers, could indicate that the domain was registered so phishing attempts could be made on former employees and customers from a legitimate-looking email address.

Related Resource

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now

Skurio's team were monitoring the state of Thomas Cook-related sites for over a year, long before it first became apparent the company was in trouble - supporting them as it would any other client. Its researchers said roughly one-to-two sites using the Thomas Cook name were consistently, like a flatline, being registered per fortnight prior to the company's issues which illustrates the extreme rise following the company's demise.

"So that flatline turned into this spike and nearly every day subsequent to that, roughly eight per day [being registered]," said Martin.

UK citizens may have already been alerted to the influx of Thomas Cook-related scams already as banks have been quick to issue alerts to customers warning against the rise in threats targeting them.

Users of the Co-operative's mobile banking app are being presented with an alert on logging in, saying: "Criminals are taking advantage of people impacted by the news that Thomas Cook have ceased trading. Never give out your bank account or card details to anybody that contacts you out of the blue".

The company also added a fraud prevention statement to its website on the day Thomas Cook announced its liquidation, as did Santander and HSBC.

Those affected by the collapse should contact the CAA in the first instance, which will be able to offer guidance on what to do next.

Featured Resources

Virtual desktops and apps for dummies

An easy guide to virtual desktop infrastructure, end-user computing, and more

Download now

The total economic impact of optimising and managing your hybrid multi-cloud

Cost savings and business benefits of accelerating the cloud journey

Download now

A buyer’s guide for cloud-based phone solutions

Finding the right phone system for your modern business

Download now

What’s next for the education sector?

A new learning experience

Download now

Recommended

New report highlights the need for diversity in cyber security recruitment
cyber security

New report highlights the need for diversity in cyber security recruitment

28 Apr 2021
eBay, Apple, Microsoft, Facebook, and Google were phishers’ top targets in 2020
phishing

eBay, Apple, Microsoft, Facebook, and Google were phishers’ top targets in 2020

20 Apr 2021
Cyber attacks against organizations increasing as more staff work from home
cyber security

Cyber attacks against organizations increasing as more staff work from home

17 May 2021
What is phishing?
phishing

What is phishing?

17 May 2021

Most Popular

KPMG offers staff 'four-day fortnight' in hybrid work plans
flexible working

KPMG offers staff 'four-day fortnight' in hybrid work plans

6 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021