IT security specialist Check Point has just identified a large-scale phishing campaign using fake Gmail accounts. Through a new version of the Rhadamanthys Stealer, emails were sent on behalf of known companies with the aim of stealing data.
According to Check Point researchers, hackers pose as legitimate companies and manage to persuade their victims that they have violated copyrights relating to their personal Facebook pages. Through hacked Gmail accounts, email addresses and language are adapted depending on the target to notify the victim of the alleged copyright infringement.
For the money
The campaign covered several continents (including Europe) and different sectors. Among the imitated companies, around 70 percent are allegedly active in the entertainment and media sector, as well as in the technology and software fields. Check Point assumes that the CopyRh(ight)adamantys campaign was carried out by a group of cybercriminals whose objective was to collect money and was not supported by a state.
According to a Febelfin investigation, no less than 40 million euros were stolen in 2023 just by imitating financial institutions from Belgian consumers. A Belgian receives on average 70 to 100 emails per day. “In other words, there is a one in 1 billion chance per day of being a victim of an email in our country,” explains Lieven Van Rentergem, security engineer expert at Check Point Software Technologies. “The phishing campaign we just discovered only confirms that we can no longer trust standard security. Hackers are becoming ever more ingenious and can easily bypass standard security from Google or Microsoft. »
At the same time that Check Point Research uncovered the phishing campaign, the company itself received notifications of phishing lures imitating Check Point emails. According to the security specialist, this action demonstrates that Rhadamanthys is being launched on an ever-broader scale.
