{"id":78798,"date":"2023-09-21T16:20:50","date_gmt":"2023-09-21T13:20:50","guid":{"rendered":"https:\/\/indexeconomic.com\/?p=78798"},"modified":"2023-09-21T16:20:50","modified_gmt":"2023-09-21T13:20:50","slug":"kaspersky-discovers-harmful-phishing-scam-targeting-employee-self-evaluation-requests","status":"publish","type":"post","link":"https:\/\/indexeconomic.com\/?p=78798","title":{"rendered":"Kaspersky discovers harmful phishing scam targeting employee self-evaluation requests"},"content":{"rendered":"\n

<\/p>\n\n\n\n

Kaspersky has uncovered a concerning phishing scheme that poses a threat to corporate systems by targeting employees. This deceptive scheme presents itself as a self-evaluation form originating from HR departments but has a sinister agenda of stealing sensitive information.<\/strong><\/a><\/p>\n\n\n\n

It is a common practice within large organizations that employees seldom have share their thoughts regarding career aspirations, areas of interest, or achievements beyond their job descriptions. Typically, such discussions only take place once a year during performance reviews. Yet, many employees would like to have more opportunities to communicate with management. When an email inviting them to participate in a self-evaluation arrives, especially one that claims to be mandatory, they often seize the opportunity without hesitation. This is the very opening that cybercriminals are exploiting in their latest spear-phishing campaign.<\/p>\n\n\n\n

In this fraudulent scheme, cybercriminals send emails convincingly crafted to appear as if they originate from HR departments. These emails offer a self-evaluation form as a way for employees to engage with their managers. However, these deceptive emails exhibit several clear signs of phishing.<\/p>\n\n\n\n

Firstly, the sender’s email address doesn’t align with the company’s, raising suspicions from the outset. Secondly, the email exerts pressure by insisting that everyone must complete the form by the end of the day, a common tactic employed by scammers to create a sense of urgency. Furthermore, when recipients click on the provided link, they encounter questions that, at first glance, seem innocuous. However, the scheme’s true nature becomes apparent in the final three questions, which request the victim’s email address, password, and password confirmation.<\/p>\n\n\n\n

This deceptive approach catches victims off guard because it asks for sensitive information towards the end of the process. To further avoid detection, the word “password” is concealed, adding some sophistication to the scam.<\/p>\n\n\n\n

\u201cWe urge corporate employees to exercise caution when receiving such emails, especially those resembling HR communications. To protect their data, it’s crucial to verify the authenticity of unsolicited self-evaluation requests directly with their HR department,\u201d<\/em> comments Roman Dedenok, a security expert at Kaspersky.<\/p>\n\n\n\n

Read more about this spear-phishing campaign on Kaspersky Daily<\/a>.<\/p>\n\n\n\n

To keep your data protected from phishing attacks and leaks, Kaspersky experts recommend:<\/p>\n\n\n\n