PHISHING SCAM – ‘Refer to Documents via Dropbox App’

This email requests that you click a link to refer to ‘urgent and highly confidential’ documents using the Dropbox app. It instructs you to click a ‘Dropbox’ link to download the documents and asks that you ‘kindly do the needful’.

However, the email has no connection to the popular file storage and sharing service Dropbox and the link does not open any documents, urgent or otherwise.

Clicking the link takes you to a bogus website that claims you must log in to your webmail service provider before you can view the supposed document. The page features clickable icons for several popular email service providers, including Gmail, Yahoo, and Outlook. The page also includes a generic ’email account’ icon aimed at people with accounts not specifically listed.

If you click the icon corresponding to your email provider, you will be taken to a second fake page that asks you to submit your account email address and password to ‘login’.

The criminals running the scam can collect the login credentials you supply and use them to hijack your email account. Once they have gained access to your account, they can use it to launch spam and scam campaigns. Because these spam and scam emails come from your account and may include your normal email signature, people on your contact list may be more inclined to believe that the messages are true and follow any instructions they contain.

These attacks attempt to panic recipients into clicking links and submitting their details because they mistakenly believe that there is an urgent and confidential matter that they must attend to.

Cybercriminals commonly send out fake messages claiming that recipients need to click a link or open an attached file to view an important document. Many, like the one discussed here, are used to trick people into supplying their personal information. Others are used to distribute malware.

If you receive such a message, do not click any links or open any attachments that it contains.