Wetransfer account password#

Upon ‘logging in’ and clicking on the link to ‘download file’, users are shown a response stating the password entered is incorrect. Unsuspecting recipients who click on the link are led to a fake WeTransfer-branded login page. A link is provided to 'Download your docs here' The email body is poorly formatted, with a blue banner containing 'WeTransfer.' The message body advises the recipient that they have received a file via WeTransfer. Using a display name of 'WeTransfer', the email actually came from one of several malicious senders. That question became all the more pertinent when MailGuard detected a new phishing email scam infiltrating inboxes on 10 th of December 2019 afternoon (AEST). But how can you tell if links to such important documents are safe to click when they appear in your inbox? And never use the same password for accessing different accounts.ĭid you enjoy reading this article? Like our page on Facebook and follow us on Twitter.Confidential business documents such as contracts, legal documents and finance records are commonly passed on from one recipient to another via email. Don’t forget to implement multi-factor authentication ( MFA) on all personal and business accounts. Pay attention to the language used within the email.

Wetransfer account how to#

How to Stay Safe?īe very mindful of minor inconsistencies in the sender’s name, email address, and domain name. The only thing that makes it appear fishy is that Microsoft is spelled as MicroSoft. The email’s HTML styling is eerily similar to WeTransfer, and the phishing page has been designed to appear as Microsoft Excel’s legitimate login page. This includes social engineering, as the email title, content, and sender name have been designed to create a sense of “trust and urgency in the victims,” wrote Armorblox’s Mark Royall in a blog post.Īnother technique used in this campaign is brand impersonation. Image via Armorblox Techniques Used in the AttackĪ range of techniques has been used to evade conventional email security filters and lure unsuspecting users. Last year, Infosec analyst Laur Telliskivi reported about the same domain being used in phishing attacks. The email sender domain is a web hosting services provider called ‘valueserverjp.’ This domain is based in Japan. It already contains the victim’s email address to create a sense of legitimacy around the entire process. When the victim clicks on View Files, the link leads them to a phishing page supposedly of Microsoft Excel.įurthermore, it features a blurred-out spreadsheet as the background, and a form is displayed in the foreground that requires the victim to enter login credentials. The email body reveals that WeTransfer has shared two files with the victim, and there’s a link to view them. SEE: ‘Zoom account suspended’ phishing scam steals Office 365 credentials The email body also makes several references to the target organization to appear legitimate. The similarity is enough to come across as a genuine WeTransfer email and can easily deceive unsuspecting users. The phishing email appears to be sent by WeTransfer as it bears the sender name Wetransfer and has the title View Files Sent Via WeTransfer. It is worth noting that WeTransfer is used for sharing files that are too large to be sent via email. The primary aim of this attack is to retrieve the victims’ Office 365 email credentials. The phishing email claims that WeTransfer has shared two files with the victim, and there’s a link to view them.Īccording to a report from Armorblox, cybercriminals are spoofing the WeTransfer file hosting system to carry out credential phishing attacks in which spoofed email leads to a phishing page featuring Microsoft Excel branding.