Netflix Bait: Phishers Target Streamers with Fake Service Signups

Lures dressed up to look like movie and TV streaming offers are swiping payment data.

The past year’s massive migration of movie and television audiences to streaming services has provided scammers with a sweet opportunity to launch phishing attempts to lure would-be subscribers into giving up their payment information.

Where there’s payment data, cybercriminals are sure to follow, Kaspersky’s Leonid Grustniy pointed out in his latest report, warning about phishing campaigns disguised to look like Netflix, Amazon Prime and other streaming service offers.

“Streaming services offer a variety of payment plans, but generally they all involve paying with a credit card,” Grustniy explained. “And where there are card details, there is phishing.”

Scam Subscriber Targeting

Kaspersky’s researchers observed various lures aimed at targets, depending on their current streaming subscription status. Fake sign-up pages for services like Netflix were used to pry email addresses and credit-card information from victims.

“Armed with your info, they can withdraw or spend your money right away; your email address should come in handy for future attacks,” Grustniy wrote.

Current Netflix subs were sent a phishing email requesting they update their billing information.

“We’re having some trouble with your current billing information,” the email read. “We’ll try again, but in the meantime, you may want to update your payment details.”

A link to “Update Your Account Now” followed, along with the signoff, “Your friends at Netflix.”

The link leads to a malicious payment confirmation page addressing “costumers” instead of “consumers.”

Stealing Payment Information

Another tactic aimed at streamers and observed by Kaspersky researchers included fake offers to stream popular shows like Disney’s The Mandalorian. Victims would watch a trailer, then be asked for a fee to continue, giving the scammers their payment details, the report said.

“What follows is a classic scenario: Any payment details users enter go straight to the crooks, and the never-before-seen episode remains such,” Grustniy added.

Stolen streaming credentials are also valuable and have been sold in underground markets.

“After all, depending on your Netflix plan, you can stream on (up to four) devices simultaneously, and cybercriminals can sell your login credentials to any number of streamers,” Grustniy wrote. “That means you might find yourself having to wait in line until some stranger decides to sign out.”

Even worse, the subscription’s stolen password could be used in attacks against other victim accounts, according to the report.

The widespread cultural influence of video streaming services is increasingly being weaponized by scammers. The explosion in worldwide interest in Netflix’s Squid Game recently helped scam crypto investors out of more than $3.3 million, for instance.

Last spring, Check Point Research discovered a malicious Netflix app in the Google Play store and spread through WhatsApp messages.

Kaspersky advises users to avoid clicking on any emails that appear to be associated with streaming services, and to pay attention to obvious signs it’s a scam, like misspellings in communications where they’re asked for payment information.

“Do not trust any person or site promising viewings of movies or shows before the official premiere,” Grustniy added.

Cybersecurity for multi-cloud environments is notoriously challenging. OSquery and CloudQuery is a solid answer. Join Uptycs and Threatpost for “An Intro to OSquery and CloudQuery,” an on-demand Town Hall with Eric Kaiser, Uptycs’ senior security engineer, and find out how this open-source tool can help tame security across your organization’s entire campus.

Register NOW to access the on-demand event!

Suggested articles