Latest scams, fraud and security alerts

 Posted on 31 October 2024

Bulk email extortion scam targets Australians

Type:  

ScamWatch has published an alert about criminals attempting to extort Australians through emails. The email falsely claims to have compromising images or videos of the intended victims obtained by hacking into people’s computers or webcams.

The criminals threaten to release the images or videos unless paid, using personal details like birth dates and addresses to intimidate victims. These details likely come from previous data breaches.

If you receive such emails, do not respond, or pay any money. This scam is a type of threat and impersonation scam, where criminals may use intimidation to extort money.

For more information visit: Scam alert: Bulk email extortion scam | Scamwatch
 

 Posted on 21 October 2024

Bank impersonation scam alert

Type:  

How does it work?

The National Anti-Scam Centre is warning consumers to be wary of bank impersonation scams.  ANZ encourages customers to be cautious of any unsolicited calls, emails or messages from someone claiming to be from their bank, requesting they provide their personal or financial information, transfer funds, or provide a one-time security code over the phone.

Scammers often claim to be calling from the bank’s fraud department and may refer to an account compromise, suspicious transaction, or online banking outage to try to create a sense of urgency.

The call may appear to come from the bank’s legitimate phone number or a very similar number, or by a text message that appears in the same conversation thread as genuine bank messages or an email appearing to come from the bank.

Remember, ANZ will never ask you to:

• Share sensitive information like your One Time Passcode (OTP), verification code (for payment), PIN or card details.
• Transfer money to another account.
• Open a new account.
• Provide access to your device.
• Download software.

 Posted on 20 September 2024

Bank impersonation scam alert

Type:   

How does it work?

Unfortunately, we are still seeing instances of bank impersonation scams, and urge customers to be cautious of SMS messages or phone calls claiming to be from ANZ. Bank impersonation scams occur when a scammer makes direct contact with you suggesting that they’ve identified a problem and that they’re trying to assist you. Be cautious of SMS messages or phone calls, claiming to be from ANZ. The scammer may ask you to provide your sensitive personal and/or banking information, transfer money, open another account, click on a link, or download software.

Remember, ANZ will never ask you to:

• Share sensitive information like your One Time Passcode (OTP), verification code, PIN or card details.
• Transfer money to another account.
• Open a new account.
• Provide access to your device.

 Posted on 30 August 2024

Alert from the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) on impersonation scam

Type: 

The ASD's ACSC has published a medium alert regarding email scammers impersonating the ASD's ACSC by sending out phishing emails to the public with the email content suggesting to download a malicious antivirus program.

The cybercriminals are emailing from spoofed email accounts utilising ASD’s ACSC’s logo, with the subject and contents of the email varying. These emails suggest that an increase in cyber threats requires the recipient to download ‘Antivirus’ software through a malicious link to stay safe. If clicked on, there is potential that malicious software could be downloaded and installed to the individual’s computer.

ASD’s ACSC encourages Australians to not click on links within the email, report it and block the sender. If you have clicked the link, require assistance, or if you’re not sure it’s a real email from ASD’s ACSC you can contact the ASD's ACSC via 1300 CYBER1 (1300 292 371).

For more information, please read the Australian Cyber Security Centre’s alert - Email scammers impersonating the ASD's ACSC.

 Posted on 20 November 2024

Payment Redirection Scam

Type:  

Be cautious when processing requests to update phone, email or bank details from third-party suppliers. These requests could be part of a payment redirection scam.

Cybercriminals may impersonate a legitimate supplier, create a fake business and ABN, and contact your business, requesting updates to supplier details such as:

• New contact details (phone numbers or email addresses)
• Updated bank account information

Since contact details have been updated, verification processes may fail, leading to unintentional contact with the scammer.

 Posted on 31 October 2024

Critical alert from the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC)

Type: 

The ASD's ACSC has published a critical alert regarding vulnerabilities affecting FortiManager devices.

Fortinet are aware of active exploitation of vulnerable instances. This vulnerability has been allocated a CVSSv3 score of 9.8.

 Posted on 25 September 2024

Critical alert from the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC)

Type: 

The ASD's ACSC has sent a critical alert relevant to Australian organisations who are running or administering instances of Ivanti CSA 4.6 (Cloud Services Appliance).

Customers are encouraged to apply available mitigations and patches as soon as possible.

 Posted on 16 September 2024

Critical alert from the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC)

Type: 

The ASD's ACSC has sent a critical alert regarding the vulnerabilities impacting Veeam Backup & Replication software.

There is significant exposure to the Veeam Backup & Replication vulnerabilities in Australia, and any future exploitation could have a significant impact on Australian systems and networks.

 Posted on 11 September 2024

High alert from the Australian Signals Directorate's Australian Cyber Security Centre (ACSC)

Type: 

The ACSC has published a high alert regarding vulnerabilities affecting CVE-2023-46085 and CVE-2024-21887 applications (This vulnerability impacts all supported versions ICS (9.x, 22.x) and IPS).

According to the ACSC, the vulnerability can result in deploying the destructive WhisperGate malware, for the purposes of espionage, sabotage, and reputational harm.