Email scammers posed as DOT officials in phishing messages focused on $1 trillion bill

The hackers even eventually dump their targets off at DOT's real website.

Shortly after Congress took action on a $1 trillion infrastructure bill, hackers posing as U.S. Transportation Department officials offered fake project bid opportunities to seduce companies into handing over Microsoft credentials, researchers say.

The ploy included layers of attempts to disguise the malicious appeals as authentic government solicitations, and even eventually led the would-be victims back to the actual Department of Transportation website, according to a Wednesday blog post from INKY, an email security company.

“The basic pitch was, with a trillion dollars of government money flowing through the system, you, dear target, are being invited to bid for some of this bounty,” wrote Roger Kay, vice president of security strategy for the firm.

Never mind that the infrastructure legislation hasn’t fully worked its way through Congress yet, nor that few of the phishing campaign’s targets would even be eligible for the infrastructure projects that bill would fund. It’s the most recent instance of hackers seizing on the hottest topic on Capitol Hill, with another notable example coming in March when Cofense spotlighted phishing lures tied to the $1.9 trillion American Rescue Plan for COVID-19 relief.

INKY said the latest fraud effort illustrated some new twists on old techniques.

“By creating a new domain, exploiting current events, impersonating a known brand, and launching a credential harvesting operation, the phishers came up with an attack just different enough from known strikes to evade standard detection methods,” the blog post reads.

The 41 phishing emails INKY detected between Aug. 16-18, a week after the Senate passed the infrastructure bill out of its chamber. House Democratic leadership is setting an October goal for final action.

The unknown phishers’ initial emails came from a “transportationgov.net” domain that offers the air of an authentic government website, and includes a link to a big blue button reading “CLICK HERE TO BID.” Doing so leads to another site with “.gov”-eseque domain names soliciting e-mail sign-ins, then to a copy of the DOT website. Then comes the credential harvesting form with a Microsoft logo.

“In what may be an ironic twist, the phishers also copied and pasted in a real warning about how to verify actual U.S. government sites,” Kay said. “The victim might have noticed that something was up if they had realized that the phishing site domain ended in .com rather than .gov or .mil.”

After entering credentials, a victim would receive a fake error message and get redirected to the real DOT website.

“This last move, dumping victims on a real site is an elegant but perhaps unnecessary flourish that phishers often execute as the final step of their sequence,” according to the blog post. “In the con business, this moment is called the ‘blow-off’ and refers to the time after which the perpetrator has obtained what they were after, but before the mark realizes that they’ve been duped.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure