Anticipation surrounding the upcoming 93rd Academy Awards broadcast on Sunday is being used by scammers to trick people into giving up their credentials — they think they’re about to stream Oscar-nominated films, but the reality turns out to be much different.
Prior to the winners being announced during the ceremony, many film fans like to watch as many of the nominated movies as possible. Scammers know this and are ready to strike.
“In the hopes of watching an Oscar-nominated movie, users visited a site where they were shown the first few minutes of the film before being asked to register to continue watching,” a Kaspersky report issued Friday on the scam detailed. “During the registration, to confirm their region of residence, the victim was asked to enter their bank-card details. After some time, money was debited from the card, and as expected, the film did not continue to play.”
Titles From ‘Best Picture’ Oscar Categories Most-Abused
Films are also being used to spread malware. Over the past year, Kaspersky’s team of researchers identified around 80 malicious files associated with films nominated in the Oscars’ “Best Picture” category. Of those, 70 percent spread via links to purportedly watch one of three movies: Judas and the Black Messiah (the most-abused film, accounting to 27 percent of the malware); Promising Young Woman with 22 percent; and Trial of the Chicago 7, which was associated with 21 percent of the abused files.
A scam site offering streams of Oscar-nominated films. Source: Kaspersky.
Other Academy-Award-nominated film titles used in to spread malware include Nomadland (14 percent), Mank (6 percent), Minari (5 percent), The Father (3 percent) and Sound of Metal (3 percent), Kaspersky found.
The analysts added that this type of attack is common, but that security concerns are waning a bit thanks to the rise of streaming services and improved security surrounding video content.
“Cybercriminals have always tried to monetize users’ interest in various sources of entertainment, including movies,” Anton V. Ivanov, a security expert at Kaspersky said. “We see that big events in the film industry can boost some interest from the cybercriminal community, but today this type of malicious activity is not as popular as it used to be. Nowadays, more and more people are switching to streaming services, which are more secure because they do not require downloading files. Still, films serve as a popular lure to spread phishing pages and spam emails.”
Global Headlines Make Good Paydays for Scammers
Almost any worldwide headline-producing event is an opportunity for cybercriminals to cash in. Everything from holidays like Valentine’s Day to global sporting events like the FIFA World Cup are potential lures for victims excited to get in on the frenzy.
The best protection against these types of scams is educating users not to click on these malicious links in the first place.
“Teaching employees how to recognize phishing emails like these is just as important as putting in place protective systems,” Heather Paunet, senior vice president at Untangle, told Threatpost. “As security adversaries find creative new ways to infiltrate networks, keeping employees trained and up-to-date is necessary to strengthen your network security.”
Download our exclusive FREE Threatpost Insider eBook, “2021: The Evolution of Ransomware,” to help hone your cyber-defense strategies against this growing scourge. We go beyond the status quo to uncover what’s next for ransomware and the related emerging risks. Get the whole story and DOWNLOAD the eBook now – on us!
