Popular cloud accounting company Xero is among the latest firms to be brandjacked. Cybercriminals are sending hoax invoice notifications purporting to be from the company to users.
MailGuard detected this scam infiltrating inboxes around late Tuesday morning yesterday (AEDT) using the display name ‘Xero Subscription Notifications’. The body of the email is simple, advising recipients that their Xero invoice is ready, and that the amount in the invoice will be debited from their credit card. The fraudulent email actually comes from a large number of different compromised email accounts.
The email includes several links leading to legitimate Xero help pages. A link to the bill is also provided, containing an invoice number (for example: INV- 8232842 as in the below screenshot).
MailGuard suspects that recipients who click on the link containing the invoice number initiate the download of a malicious payload designed to infect systems.
Scam-spotting
Eagle-eyed recipients will notice that real Xero invoices commonly use a PDF attachment rather than a link to an external website.
Another easy way to check potentially-suspicious emails is to hover your mouse over the sender’s address. This will reveal more about the real sending domain.
In this particular scam, cybercriminals have tried to make the email look as legitimate as possible by including the link to Xero Central’s ‘support article’ – a feature commonly included in authentic notifications from such a well-established cloud accounting company.
Accountants, bookkeepers and financial professionals are particularly attractive to cybercriminals who know that they hold access to valuable financial information for company payrolls, invoicing, and the like.
One Email
If your company is using an online platform like Xero, then you already know the benefits of cloud-based technology. Doing business online opens up opportunities for collaboration on an unprecedented level, but with that opportunity comes significant risk.
Cybercriminals utilise sophisticated AI technology to monitor business and social networks and they exploit the data they collect to infiltrate organisations. All criminals need to break into your business is a cleverly worded email; if they can trick one person in your company into clicking on a malicious link they can gain access to your data.
For a few dollars per staff member per month, add MailGuard's cloud-based email and web filtering solution to your business security. You’ll significantly reduce the risk of new variants of malicious email from entering your network. Talk to an expert at MailGuard today about your company's cybersecurity needs: expert@mailguard.com.au
Keep up to date on the latest email scams by subscribing to MailGuard’s weekly update, or follow us on Twitter @MailGuard.
