Scammers Pose as Meal-Kit Services to Steal Customer Data

[silversurfer]

Attackers are piggybacking off the booming market for meal-kit delivery services since the pandemic, and sending SMS phishing messages doctored up to look like they’re legitimate correspondence from popular brand names — including HelloFresh and Gousto.
 
This is just another example of why the world cannot have nice things.
 
Researchers at Tessian discovered the meal-kit phishing campaigns and said there are many versions of the phishing pitch. Some are received through SMS, others through WhatsApp. Some ask customers to rate their experience to enter a prize. The messages run the gamut in terms of sophistication from very convincing, to an example Tessian called “easy to spot,” which is riddled with spelling errors.
 
“Your Gousto box is now delivered,” the phishing message read. “Enjoy the reoipej! Rate delivesy and enter wrize diaw at ‘URL’.”
 
The goal is to drive users to a site controlled by the attackers and trick them into entering their personal data.
 
“Where there is consumer demand, there are always cybercriminals looking to capitalize on these trends and trick people into sharing valuable information or those all-important account credentials, Charles Brook, threat-intelligence specialist with Tessian, told Threatpost about the findings. “So as demand for meal-kit deliveries surge, due to lockdown restrictions, so too have social-engineering scams with hackers posing as these brands.”
 
Data released from Nielsen showed meal-kit sales grew nearly 19 percent in 2020 as a result of COVID-19 restrictions.

Read more: Scammers Pose as Meal-Kit Services to Steal Customer Data | Threatpost