As another year begins, Netflix continues to be a favourite among cybercriminals looking to trick users. The popular entertainment company has once again been impersonated in a phishing email scam intercepted by MailGuard.
These malicious emails are infiltrating inboxes using a display name of ‘Netflix Membership’ and are titled ‘We recently detected an issue with the billing information associated with your Account’. However, the sender email address provided in the “From:” field doesn’t use a domain belonging to Netflix – a huge red flag pointing to the email’s illegitimacy. The emails are actually sent from a compromised account based overseas.
The email body addresses the recipient directly and includes Netflix’s branding and logo. It informs recipients that 'payment for the next billing cycle' of their subscription could not be authorised, and as such, their membership has been suspended. Recipients are advised to update their details via a button titled ‘Login To Get Started’, and the email ends with a footer advising recipients not to reply to the email directly.
Here’s what the email looks like:
Recipients who click on the button are led to an intermediary page that automatically redirects to a login page asking users for their email address and password. As you can see from the screenshot below, this page is designed to look like a legitimate page belonging to Netflix:
Interestingly, the domain used in the page’s URL doesn’t belong to the company. This is actually a phishing page hosted on a compromised website. Once users “sign in” to their accounts, their credentials are harvested and they are led to the following page asking them to choose their method of payment, as per the below:
Clicking on either option leads users to another page prompting them for their payment details. Depending on the option chosen by the users, this page asks them either for their credit card information or their PayPal credentials, as per the screenshots below:
These are also phishing pages that are designed to harvest users' confidential banking information. After users input their details as required in the fields above, they are led to a Netflix-branded confirmation page informing them they have ‘restored access’ to their account. Here's what the page looks like:
Clicking ‘Home’ finally leads users to Netflix’s actual homepage.
Whilst MailGuard is stopping this email scam from reaching Australian businesses, we encourage all users to exercise caution when opening messages, and to be extra vigilant against this kind of cyber-attack. If you see an email from Netflix, please make sure it is a legitimate communication before you open it. Please share this alert with your social media network to help us make the people aware of the threat.
Netflix is a regular target for cybercriminals. With more than 203 million subscribers worldwide, there’s a high likelihood that many of those that are receiving the email are subscribers and that a portion of those will be too time poor to check the details in the email. Over the years, MailGuard has regularly intercepted Netflix-themed email scams, including in:
In this particular scam, cybercriminals have employed the following techniques to trick users:
Besides the above, the inclusion of PayPal’s logo and branding is also intentional. Being a widely used and trusted online payments service supporting a plethora of online stores, PayPal is a popular target for cybercriminals, especially as more users shop online due to the closure of many physical stores during the COVID-19 pandemic. Many of us rely on PayPal as a trusted means of making and receiving payments securely, so most of us wont think twice when asked to insert our PayPal details, as in this case. Cybercriminals behind this scam are leveraging on PayPal’s trusted reputation to further convince users that the email and its links are legitimate, motivating them to provide their confidential financial details. In addition, scams that are initiated from compromised accounts (like this one) are particularly dangerous, because the emails are sent from a legitimate account, so they are not likely to be blocked by email security services.
How to know if an email or text is actually from Netflix?
Netflix lists the following advice on its support page:
More information can be found here: https://help.netflix.com/en/node/65674
As a precaution, MailGuard urges you not to click links within emails that:
One email is all that it takes
All that it takes to break into your business is a cleverly-worded email message. If scammers can trick one person in your company into clicking on a malicious link they can gain access to your data.
For a few dollars per staff member per month, you can protect your business with MailGuard's predictive and advanced email security.
Talk to a solution consultant at MailGuard today about securing your company's network.
Why not stay up-to-date with MailGuard's latest blog posts by subscribing to free updates? Subscribe to weekly updates by clicking on the button below.