Chipotle’s marketing email hacked to send phishing emails

Over 120 emails attempted to steal login credentials from victims

Chipotle sign on the side of a brick building

Hackers have abused an email account linked to the Chipotle restaurant chain to send phishing emails to unsuspecting victims.

According to cyber security company Inky, between July 13 and 16 this year, researchers  detected 121 phishing emails in a similar attack that originated from a compromised Mailgun email marketing account used by the chain. 

It said that of those 121 attacks, two were fake voicemail notifications with malware attachments (also known as vishing), 14 impersonated USAA Bank and had mail.company[.]com links that redirected to a malicious USAA Bank credential-harvesting site, and the other 105 impersonated Microsoft and had mail.company[.]com links that redirected to a malicious Microsoft credential-harvesting site.

Researchers said the bulk of the attacks impersonate Microsoft. The giant software company is often the subject of impersonations because Microsoft credentials are highly valuable.

“Almost everyone has a Microsoft account, and logins there can lead to all kinds of interesting data, including other logins, trade secrets, financial details, and other intelligence,” said researchers.

Researchers said the attacks were highly effective because all phishing emails came from an authentic Mailgun IP address (166.78.68.204), passed email authentication (SPF and DKIM) for company[.]com, and used high reputation mail.company[.]com URLs as redirectors to malicious sites.

Niamh Muldoon, Global Data Protection Officer at OneLogin, told ITPro that she predicted we might hear more about these types of breach disclosures as well as privacy-related fines being imposed on companies contracting marketing platform providers.

“Oftentimes the data is left within these platforms with sites left on the internet after marketing or conference events, and security monitoring as well as alerting is not in place, making them easy targets for attack,” she said.

“We all know these platforms process and store data that is in demand (contact details) and therefore, easily sold on dark web and/or to sales teams. How many times have you received an email asking you if you were interested in buying a leads list? This is likely just one of many cases we’ll hear this year of marketing accounts being hacked.”

Jamie Akhtar, CEO and co-founder of CyberSmart, told ITPro that hackers are often quick to adapt their strategies to increase their chances of success. As is the case here with Chipotle, cyber criminals have recognized that sending emails from a legitimate address can go a long way in deceiving individuals. 

“Unfortunately, phishing attempts have become so sophisticated that our general advice for spotting suspicious emails may be becoming outdated. Security awareness training remains pivotal but greater emphasis should be placed not solely on spotting these emails but also reporting them so that we may collectively learn the latest tactics of these hackers and prevent others from getting caught up in it,” he said.

Featured Resources

Modern governance: The how-to guide

Equipping organisations with the right tools for business resilience

Free Download

Cloud operational excellence

Everything you need to know about optimising your cloud operations

Watch now

A buyer’s guide to board management software

How the right software can improve your board’s performance

The real world business value of Oracle autonomous data warehouse

Lead with a 417% five-year ROI

Download now

Recommended

Russia's "politically motivated" REvil raid could be used as leverage, experts warn
ransomware

Russia's "politically motivated" REvil raid could be used as leverage, experts warn

17 Jan 2022
Meta files lawsuit to uncover hackers targeting Facebook, WhatsApp
phishing

Meta files lawsuit to uncover hackers targeting Facebook, WhatsApp

21 Dec 2021
Five things to consider before choosing an MFA solution
Security

Five things to consider before choosing an MFA solution

17 Dec 2021
Australia and US sign CLOUD Act data-sharing deal to support criminal investigations
cyber crime

Australia and US sign CLOUD Act data-sharing deal to support criminal investigations

16 Dec 2021

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

6 Jan 2022
How to speed up Windows 11
Microsoft Windows

How to speed up Windows 11

7 Jan 2022
Dell XPS 15 (2021) review: The best just got better
Laptops

Dell XPS 15 (2021) review: The best just got better

14 Jan 2022