The next time you log onto a video meeting or stream a movie, it could cost you your livelihood.
This is the stark warning by IT experts, who say cyber criminals have pivoted to targeting sites like Netflix and Zoom to harvest users’ personal information – and hack their accounts.
Netflix gained over 16 million new users during the pandemic, while video conference application Zoom has seen a 1,900 percent increase in active users.
“Criminals use increasingly sophisticated methods to bypass systems that flag phishing attacks and try to trick you into revealing information that gives them access to your accounts,” Anna Collard, SVP Content Strategy and Evangelist of KnowBe4 Africa said.
Phishing scams are when a criminal sends a communication (email, phone call, text, etc.) pretending to be someone else in order to extract or access credentials, personal data, or financial information.
“And as soon as they have this information, they get into your systems and distribute malicious emails to your contacts and dive even deeper into systems and personal details.”
According to cyber security firm Check Point, phishing attacks by Netflix look-alikes doubled, with many offering payment options to steal user data and payment information.
Fake Netflix emails have been circulating claiming there are issues with users’ accounts, telling users to update their payment information. The link leads victims to a genuine-looking Netflix website designed to steal user names and passwords, as well as payment details.
“Cyber criminals can gain money, or your payment / credit card details from hacking an individual’s Netflix account,” said Collard. “The user may not even become aware of it because once they've provided their details, it redirects them to the real Netflix site. It's only once purchases are made on their credit card that it will be evident that a scam has occurred.
“Don't fall for any email, social media or WhatsApp notifications pretending to be from Netflix. The best advice is to avoid clicking on links all together and just manually type in Netflix into your browser or to use a bookmark link.
“Do not use the same password on Netflix that you use for other websites or apps and make sure it's not easily guessed.”
The streaming giant said they were aware of the increase in cyber crime on their platform and have urged users to be careful.
"Netflix has the Netflix Help Centre available across all the ways people use to stream Netflix, be it via the mobile app, a TV, online or any other way subscribers use to access Netflix.," said a spokesperson.
"During this time of increased online activity, Netflix always wants our members to be aware of any suspicious activity."
"We have information on our website which tackles Phishing or suspicious emails or texts claiming to be from Netflix. It includes what to look out for and what people should do when they receive suspicious messages."
"If a member suspects their account of being hacked, users are urged to visit the website to find out how to keep your account secure."
Zoom has also been the target of cybercrime, with more than half a million Zoom account credentials, user names and passwords becoming available on dark web crime forums earlier this year. Some were given away for free, while others were sold for as low as R20 each.
“Zoom accounts are highly attractive, as they allow hackers to distribute their phishing scams or malicious software to the victim's contact base,” said Collard. “If you are receiving a Zoom invite from someone you know and trust, you are more likely to click on the notification or invite email.
“If the criminals happen to get into your company Zoom account, then they will automatically have access to all your colleagues and other Zoom contacts. This could result in them sending phishing emails and malicious software in an attempt to steal information or distribute hate speech or other inappropriate material in your name.
“From there, they can launch further attacks, steal information or trick you with email interception fraud. (i.e., changing banking details on supplier invoices).
“It's important to keep your credentials safe by not reusing the same user name and password across multiple sites, enabling multi-factor authentication wherever possible and being careful not to fall for phishing scams that try to steal your credentials.”
There has also been an increase in cybercrime on social media platforms such as Facebook, Twitter and Instagram, said Collard.
“First off, scammers use these platforms to do research about their targets, so keep the amount of personal information shared to a minimum.
“Also, use privacy settings to control who has access to your profile and content. We are responsible for any content shared on our wall or content we are tagged in, so take control over your profile and delete inappropriate tags.
“I would also highly recommend that everyone watch the “The Social Dilemma” on Netflix. It's a great documentary outlining how the social media industry operates, driven by algorithms, that will show us content that makes us more likely to spend more time on the platform.”
Paul Williams, Fortinet Country Manager in Southern Africa, said the pandemic has resulted in a drastic increase in cybercrime.
“The first half of 2020 demonstrates the dramatic scale at which cyber criminals leveraged a global pandemic as an opportunity to implement a variety of cyber-attacks around the world according to the findings of the latest semi-annual FortiGuard Labs Global Threat Landscape Report.
“From opportunistic phishers to scheming nation-state actors, cyber adversaries found multiple ways to exploit the global pandemic for their benefit at enormous scale. The shift to remote work was an unprecedented opportunity to target unsuspecting individuals. This included phishing and business email compromise schemes, nation-state-backed campaigns and ransomware attacks.
Williams said there were a number of ways users can minimise their chances of falling victim to cybercrime.
“No longer is your user name and password good enough. Users and companies practising cyber-security disciplines have to make use of two factor authentication, Network Access control and new digitised methods to ensure that when a user login on, the company practises a zero trust policy to ensure the stringiest methods of cyber security in all parts of their IT and OT networks.”
“Be aware of what you put out on all your social media applications as this is also now being used to build personal profiles of you and information sharing amongst the hacker communities.”