New phishing campaign is taking advantage of the users’ vague familiarity with the OpenID authentication method to phish login credentials for a number of different and popular online services.
The emails in question currently take the form of an offer from a real estate company to check out “new beautiful and cheap properties for sale around your area”, or of a bogus UPS tracking alert, said researches at Barracuda Labs.
RELATED STORIES
‘Free Storage’ Phishing Emails
Russian Cybercrime Consolidates, Grows
Spammers: It Just Keeps Working
Rogue AV Lets Victims do Dirty Work
Fake Google Antivirus Circulates
After following the offered link, users end up on a fake login page hosted on a compromised site.
The page itself does not mention OpenID, but the logos of large and popular websites that use and provide the option of OpenID authentication (Google, AOL, Yahoo!, etc.) can fool users into thinking that the page is legitimate.
Whichever email provider the user selects, a pop-up window requesting the login credentials appears.
“This is not how OpenID authentication works,” the researchers said. With genuine OpenID authentication we would be directed to a secure Yahoo web page which would ask for credentials.”
In this case, the inputed credentials are simply forwarded in plain text to a remote server operated by the phishers, and the user ends up redirected to the real estate agency’s or UPS’ legitimate website.