Since March, a cybercrime campaign targets students looking for jobs. A cybersecurity company announced Wednesday.
Scammers pretending to be bioscience and healthcare companies lure students into a video chat about a job in order to get them to pay bogus charges as a requirement of employment. Proofpoint Researchers Timothy Kromphardt & Selena Larson.
Larson, a TechNewsWorld reporter, said that “Proofpoint had previously observed threat actor targeting colleges and universities with fraudulent job offers. But this one was particularly interesting, because all the companies were related and used the same lures and descriptions, as well as being in bioscience, research, or health care.”
In a blog post, the researchers explained that they received emails inviting them to video or chat interviews for remote data entry positions.
Charges Up Front Are Bogus
Researchers wrote that while Proofpoint wasn’t able to confirm requests made in the video interview, they were confident based on past related activities that the actor told the recipient he would require them to pay a fee before receiving the equipment, which would be collected by the threat actor.
Kromphardt Larson, in their findings, noted that every message sent included a pdf attachment with the required hardware and software for each offered position. The total was $7,000.
The researchers could not confirm the details of the interview with the target, but they did write that the scammers asked students to purchase the necessary equipment in advance to fulfill the job requirements, and that they would reimburse them with their first paycheque.
Students may also have received a check that they were to deposit into their account to use to purchase equipment. However, the bogus provider would take the money out of the student’s account and leave the students with the bill if the check bounced.
The researchers noted that these are “typical behaviors of threat actors who perpetrate employment fraud.” “In some cases, the actor may also ask for cryptocurrency payments to cover the ‘shipping expenses’ of items they are supposed to purchase.”
Ripe targets
A recent article in Inside Higher Ed states that after a brief hiatus, following the Covid-19 epidemic, student scams seem to be gaining momentum again. The article stated that at California State University Long Beach, each email between students includes a banner warning the recipient to be cautious of messages requesting password resets and job offers.
It is important to note that the word “you” means “you”. article Johanna Alonso explains that scammers often offer students better-paying jobs and greater flexibility on campus. It continued that, after giving a student menial jobs, scammers usually send fake paychecks to their victims before claiming overpayment and demanding the money returned.
Experts in cybersecurity say that students are a prime target for cybercriminals.
Dror Liwer is the co-founder and CEO of Coro A Tel Aviv based cloud-based cyber security company
“It’s easier to communicate authority to a novice student, and convince them to do something like send information or make a payment,”
George Jones, Chief Information Security Officer at Critical Start A national cybersecurity company. “The trusting nature students have can lead them to be more willing to accept promises from bad actors, particularly when they seem to come directly from reputable sources and offer attractive benefits,”
Network Ties
Paul Bischoff said, “Students may be more inclined to click links that offer freebies or steep discounts.” Comparitech Reviews, advice and information for consumer security products.
He told that “they’re also connected to their university network.” If hackers are able to use a student account to hack into a network at a university, they could gain access to higher privileges, and launch ransomware attacks against the entire network.
Darren Guccione CEO of Keeper Security Chicago’s, an online storage and password management company.
Schools store sensitive data on employees and students, ranging from personal identifiable information to psychological records. Cybercriminals can make a lot of money by selling this data in the dark web.
Sean McNee Vice President of Research and Data at DomainTools A Seattle-based internet intelligence firm has stated that bad actors have increased their attacks on universities due to the porous nature of these institutions and their bias towards information sharing. Budget concerns and limited resources are also contributing factors.
He told it was “saddening but not surprising” to see that bad actors are now turning their attention to students at colleges and universities.
What Students can do to Avoid Scams
Jones urges students to check the legitimacy of any job opportunities and postings before submitting their application or providing any personal information.
He also suggests researching potential employers. He said to check for contact information, and look for reports of fraud, as well checking review sites like LinkedIn or Glassdoor.
He added that you should seek guidance from trusted advisors such as professors, career counselors or mentors when evaluating financial or job opportunities. He said that they can offer valuable advice and can identify scams.
Proofpoint reminds students looking for jobs that employers won’t send them a paycheck before the first day of employment, or ask them to pay for items in advance.
Proofpoint has identified the following key elements of fraudulent job offers:
- A fake job offer is received by a Gmail or Hotmail account that pretends to be a legitimate company.
- An email address with a different domain than the official website of the company;
- No or very simplistic questions in the interview with no knowledge of the job duties.
- The PDF document or any other document that contains grammar and spelling errors, and has generic content about organizations;
- Receiving “paychecks” almost instantly after initiating a discussion.
By being informed and following these prudent, commonsense steps, students can protect themselves from online scams, fraudulent job offers, and other types of fraud.
