IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

X-rated phishing attacks just keep growing

New data from GreatHorn finds hackers increasingly using explicit material to get victims to click on malware

X-rated phishing attacks just keep growing

Hackers are increasingly using adult material in phishing attacks to lure unsuspecting victims into clicking on links to download malware, according to new research.

In a blog post by security researchers at GreatHorn, it was found that between May 2020 and April 2021, the number of such attacks increased by 974%. Researchers said that these attacks reach across a broad spectrum of industries and appear to target based on male-sounding usernames in company email addresses.

Attackers use these X-rated phishing emails as a runup to blackmail. In these attacks, cybercriminals are tracking the identity of victims who click on their sites by using a technique called an email pass-through. The same technology enables legitimate email senders to auto-populate an unsubscribe field with a user email address. 

"Once a user clicks on a link in the email, their email address is automatically passed to the linked site. In these attacks, the cybercriminal leverages the information they gleaned in order to set up a second stage. Individuals who clicked on links to compromising material could be targeted in the second attack to extort the individual," said researchers.

Researchers highlighted two campaigns where this tactic is used.

In the first one, hackers claim to be a woman that wants to meet the victim. Clicking on the link in the email takes the victim to a website with photos, this site is classified as Malicious by Google Safe Browsing. This then directs the victim to a second site, which looks like a dating website.

Related Resource

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Prevent fraud and phishing attacks with DMARC - whitepaper from MimecastFree download

"It is likely a fake site designed to hook users into providing payment information. User data gleaned in this way will be transmitted to cybercriminals, who will use it for various malicious purposes, such as money withdrawal, blackmailing, or committing further frauds," said researchers.

In the second example, a link in the phishing email sends the victim to a website with X-rated images. Victims are asked to confirm a Zip code to find individuals in their area. This website also tries to make victims provide payment information.

"User data gleaned in this way will be transmitted to cybercriminals, who will use it for various malicious purposes, such as money withdrawal, blackmailing, or committing further frauds," said researchers.

Featured Resources

Accelerating healthcare transformation through patient-centred medtech solutions

Seize the digital transformation opportunities to streamline patient care and optimise patient outcomes

Free Download

Big payoffs from big bets in AI-powered automation

Automation disruptors realise 1.5 x higher revenue growth

Free Download

Hyperscaler cloud service providers top ten

Why it's important for companies to consider hyperscaler cloud service providers, and why they matter

Free Download

Strategic app modernisation drives digital transformation

Address business needs both now and in the future

Free Download

Most Popular

Empowering employees to truly work anywhere
Sponsored

Empowering employees to truly work anywhere

22 Nov 2022
Larger monitors aren't all they're cracked up to be
monitors

Larger monitors aren't all they're cracked up to be

3 Dec 2022
Defra's legacy software problem 'threatens' UK gov cyber security until 2030
Business strategy

Defra's legacy software problem 'threatens' UK gov cyber security until 2030

6 Dec 2022