The Australian Internet Security Initiative (AISI) part of the Australian Communications and Media Authority (ACMA) has issued a warning over what is one of the most sophisticated spear phishing campaigns yet.

The emails come from BASnotification@atogovau.org and state that your next activity statement is now due. The real email address for the ATO is BASnotification@ato.gov.au. It is very well done – all links go back to the ATO website except for “Click here to download your statement.”

That link takes you to a fake ATO website that can download malware designed to steal your online banking and other credentials and can potentially open a ‘back door’ that enables installation of malware, such as ransomware.

The cybercriminals have also managed to add atogovau.org to the global list of “approved” domains and added Sender Policy Framework (SPF) that reduces the likelihood of email servers rejecting it as spam.

Protection

• It comes down to common sense - hover your mouse over all links before clicking. You need to know that atogovau.org is a fake.
• If the link asks you to install any application, say no.
• Use paid anti-malware on all critical systems.

Comment

I added the “paid” word to the AISI advice because the majority of these paid protection programs use machine learning to identify scams. For example - and it is only one provider - Symantec has created the world’s largest Global Intelligence Network (GIN) and according to the company it only takes a handful of instances to be identified before it blocks it for everyone.

Also, it has developed phishing website detection that analyses the known websites (ATO.gov.au) and can tell if another is a phishing site (atogovau.org).

It never ceases to surprise me that SMB skimps on security, many still using free or consumer-grade, anti-virus solutions when enterprise-grade will protect from these scams.