In an attempt to capitalize on the hype surrounding the 93rd Academy Awards that took place on Sunday, cybercriminals trick people into giving up their credentials while offering them to stream Oscar-nominated films.
Scammers know well that just before the winners are announced at the ceremony, many more film fans watch nominated movies.
In a campaign reported by Kaspersky researchers, scammers lure victims to phishing websites, and then after a victim has watched a movie for a few minutes, they ask them to fill out a registration form.
“In the hopes of watching an Oscar-nominated movie, users visited a site where they were shown the first few minutes of the film before being asked to register to continue watching,” a report by Kaspersky detailed.
In addition to the regular username and password, victims have to enter bank details.
“During the registration, to confirm their region of residence, the victim was asked to enter their bank-card details. After some time, money was debited from the card, and as expected, the film did not continue to play.”
Scammers also used films to spread malware. Over the past year, Kaspersky cybersecurity team identified about 80 malicious files distributed in campaigns connected to movies nominated in the Oscars’ “Best Picture” category. Researchers noted in 70% of cases attackers spread malware via links for three movies Judas and the Black Messiah (accounted for 27% of malware); Promising Young Woman (22%); and Trial of the Chicago 7 (accounted for 21% of the abused files).
Kaspersky found other Academy-Award-nominated films that attackers used to lure victims were Nomadland (14%), Mank (6%), Minari (5%), The Father (3%) and Sound of Metal (3%).
The analysts noted that such vectors of attack as this one are becoming less often thanks to the rise of streaming services and improved video content security.
“Cybercriminals have always tried to monetize users’ interest in various sources of entertainment, including movies,” Anton V. Ivanov, Kaspersky’s security expert, said. “We see that big events in the film industry can boost some interest from the cybercriminal community, but today this type of malicious activity is not as popular as it used to be. Nowadays, more and more people are switching to streaming services, which are more secure because they do not require downloading files. Still, films serve as a popular lure to spread phishing pages and spam emails.”
Educating users, especially if they are employees, on how to recognize phishing emails is the best way to protect against phishing and other types of attacks, researchers said.
