Mimecast expects cybercriminals are using AI to create sophisticated clones of legitimate government emails.(Source: Getty\/Mimecast) <\/p>\n
Australians are being bombarded with tens of thousands of fake emails<\/a> impersonating Centrelink and Services Australia<\/a> in one of the biggest phishing campaigns in years. Cybercriminals<\/a> are using artificial intelligence to create \u201csuper clones\u201d of legitimate messages, making them increasingly difficult to spot.<\/p>\n More than 270,000 of the malicious emails<\/a> have been detected in the past four months by human risk management platform Mimecast. The emails mimic legitimate communications and leverage information about benefits like superannuation<\/a>, JobSeeker payments, Medicare and Family Tax Benefits.<\/p>\n Mimecast senior director of solutions engineering Garrett O\u2019Hara told Yahoo Finance it was one of the “biggest” phishing campaigns the group had seen in the past three years.<\/p>\n RELATED<\/p>\n \u201cIt\u2019s not targeted at any specific organisation, which we do see sometimes. It\u2019s really quite a broad attack and honestly an attack on fairly vulnerable people<\/a> when you think about the services involved here, which is kind of sickening,\u201d he said.<\/p>\n While it’s unclear the degree to which AI<\/a> is being used, O\u2019Hara said the convincing and large scale nature of the scam meant it was almost certainly playing a part.<\/p>\n \u201cIf you start to look at the phishing scams that are coming through now they\u2019re actually very excellent. They\u2019re so, so convincing and that\u2019s no accident,\u201d he said.<\/p>\n \u201cYou remember the advice to look for grammar that\u2019s wonky or syntax, that\u2019s all gone \u2026 [We\u2019re] seeing a perfectly written email, really in any language, with good syntax and perfect grammar and exactly the same layout as the real deal \u2013 that\u2019s trivial to do with AI.\u201d<\/p>\n Do you have a story to share? Contact tamika.seeto@yahooinc.com<\/a><\/p>\n In some cases, scammers<\/a> can go a step further by compromising real email accounts and hosting fake government login pages on legitimate web services, making them even harder to detect.<\/p>\n Once you click a link and enter your details, attackers are able to gain access to your personal or business accounts, which can lead to data theft, malware installation, or ransomware infections.<\/p>\n O\u2019Hara said there were major consequences potentially at stake, including identity theft<\/a>.<\/p>\n \u201cA lot of people, unfortunately, they still use the same email address and passwords for lots of different services,\u201d he said.<\/p>\n \u201cIf you\u2019re doing that and you\u2019re getting compromised as part of this attack, there\u2019s a thing called credential stuffing where they take the credentials they\u2019ve stolen in a previous attack and then they just try different platforms.\u201d<\/p>\n Story Continues <\/p>\n Services Australia confirmed to Yahoo Finance it was aware of the scams, but it’s understood it is not seeing a significant increase.<\/p>\n “It\u2019s an unfortunate reality that phishing scams are becoming more sophisticated. Our advice remains the same on this ongoing threat,” Services Australia general manager Hank Jongen said.<\/p>\n “The most important advice is not to click on links in email scams claiming to be from Services Australia or myGov. We won\u2019t send links in text messages or emails asking you to sign into your myGov account or Centrelink online account.”<\/p>\n Services Australia<\/a> will never send you a link, attachment or QR code in an email or text message. Additionally, if the website URL doesn\u2019t end in \u2018.gov.au\u2019 then it is not an official government website.<\/p>\n The government agency shares active scams on its website<\/a>, including myGov phishing emails which include a link, button or icon that takes you to a fake myGov website.<\/p>\n Aussies who have clicked on a suspicious link or given out their personal details are advised to call Services Australia’s Scams and Identity Theft Helpdesk on 1800 941 126.<\/p>\n “Remember to always type my.gov.au into your website browser so you know you have the real myGov website, or use the official myGov app,” Jongen said.<\/p>\n Aussies can also set up passkeys in myGov, a digital ID, or a passphrase and two-factor authentication for help keep their account safe.<\/p>\n O\u2019Hara said scammers<\/a> would try to evoke an emotional reaction to convince you to click a link, such as claiming your account has been compromised or your payment will be suspended.<\/p>\n \u201cIf you’re seeing that kind of very emotional or anything in any email that’s evoking that response, just pause, take a breath,\u201d he said.<\/p>\n \u201cThen the biggest thing I would say is don’t click on the link. Go to myGov through the internet. Sit down at your desk or laptop or on your phone, and just open your browser and go to myGov directly and log in directly without clicking on the link within the email.”<\/p>\n If it\u2019s real, you will see a notification or message in your myGov inbox. Alternatively, you can also call Centrelink directly and check.<\/p>\n O’Hara said many organisations now do not send links within emails or ask for your personal information via email.<\/p>\n While the downside of this is ease of use, O’Hara said it was worth it.<\/p>\n “I think that’s a valuable trade-off. I’d much rather take an extra two minutes to do something then have the potentially huge impact of credential theft or credential harvesting,” he said.<\/p>\n Get the latest Yahoo Finance news – follow us on Facebook<\/a>, LinkedIn<\/a> and Instagram<\/a>.<\/p>\n Mimecast’s Garrett O’Hara has urged people to slow down and not click any links provided in the emails. (Source: Mimecast) <\/p>\n
The emails will try and create a sense of urgency and get you to click a link. (Source: Mimecast) <\/p>\n