US financial regulatory body warns its members of ongoing phishing campaign
FINRA issues an urgent security alert to its members
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
The US Financial Industry Regulatory Authority (FINRA) has issued a notice on its website warning of fraudulentphishing emailsclaiming to be from itself.
In the alert to members posted on its notices page, FINRA explains that there is a widespread, ongoing phishing campaign that involves fraudulent emails purporting to be from FINRA officers, including vice presidents Bill Wollman and Josh Drobnyk.
Members are warned that the suspect emails have a source domain name ‘@broker-finra.org’, and request immediate attention to an attachment relating to your firm. As a result, FINRA has urged members to change their passwords and also notify relevant staff members about the attacks.
Ongoing threat
FINRA has explained that the malicious emails have been targetingMicrosoft OfficeandSharePointaccount passwords. Emails often, but not always include an attached PDF file that contains a link to a website where members are required to enter their passwords.
The notice on the FINRA website also underlines the need to remain vigilant. It states: ‘The domain of “broker-finra.org” is not connected to FINRA and firms should delete all emails originating from thisdomain name. In addition, FINRA has requested that theInternet domain registrarsuspend services for “broker-finra.org”.’
“FINRA recommends that anyone who entered their password change it immediately and notify the appropriate individuals in their firm of the incident,” Dave Kelley, FINRA Director of Member Supervision Specialist Programs toldZDNet.
In addition, he also underlined how the attacks were using another less obvious technique. “In at least in some cases, the emails do not actually include the attachment,” Kelley said. “They may be attempting to gain the recipient’s trust so that a follow-up email can be sent with an infected attachment or link, or a request for confidential firm information.”
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
FINRA is a not-for-profit organization working on behalf of brokerage firms and exchange markets. Any successful phishing attacks could result in criminals accessing the Office accounts of businesses who work at the heart of the New York Stock Exchange.
Rob Clymo has been a tech journalist for more years than he can actually remember, having started out in the wacky world of print magazines before discovering the power of the internet. Since he’s been all-digital he has run the Innovation channel during a few years at Microsoft as well as turning out regular news, reviews, features and other content for the likes of TechRadar, TechRadar Pro, Tom’s Guide, Fit&Well, Gizmodo, Shortlist, Automotive Interiors World, Automotive Testing Technology International, Future of Transportation and Electric & Hybrid Vehicle Technology International. In the rare moments he’s not working he’s usually out and about on one of numerous e-bikes in his collection.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
NYT Strands today — hints, answers and spangram for Sunday, November 10 (game #252)
