For cybercriminals, any excuse is used to organize a campaign of attacks. This time, the sights are set for the next Easter and in the famous chocolate egg. Deception comes through various messages in which the unwary believes that they will receive a strange surprise.

This type of cybercrime is known as a “seasonal scam” and in connection with Easter it is mainly associated with chocolate eggs. The experts who detected the scam were BTR Consulting, a consulting firm that specializes in cybersecurity.

“The contact received via WhatsApp, Facebook and Instagram an attractive offer to participate in a contest. If they can access a link they can get a free easter eggs or gift cards to send to a friend or relative ”, they indicated from BTR Consulting.

To receive the prize it is necessary answer a short survey. The message states that the contact who sent the invitation has already received their reward, including to lend credibility to this deception.

Once the user opens the suspected treasure, they will be given questions. But the website was accessed it is a deceptive imitation and requesting sensitive information, such as credit cards and bank accounts, that could be used against the person.

While one was busy answering the questionnaire, the other mechanisms were activated in the background. “In some cases, the message is shared automatically along with the user’s contact list“, added from BTR Consulting.

It’s been five years since this scam has been spreading for a few days, but its charges are improving, they pointed out from the research firm.

No wonder how effective criminals are at confusing users with real marketing campaigns from chocolate companies.

A classic

The easter egg cyber scam is a phishing, as they seek to keep personal data, users, passwords and banking or financial information.

“Users should avoid interacting with the message in any way and not enter any data or further share the message,” the experts note.

phishing is a social engineering technique which consists of tricking a user into stealing personal data. These may include your access codes and other passwords of banking entities, emails.

The trick is to hide the deception as something trustworthy, like a sweepstakes, to build trust. Many times even well -known brand or company names are used to achieve this goal.

recommendations

• Hackers often use URLs for their fake websites that are only one character different from the real website. Before clicking on any web address from an email message asking you to take action, hover over the link.
• Use multi-factor authentication, which requires users to go through a series of steps to verify their identity. Sometimes a message arrives on the cell phone and you need to put it on a site to validate the information.
• Never provide personal data, username and password, bank account number or credit card number.
• Don’t trust messages coming through WhatsApp that offer surprising prizes and/or gifts. Even if they come from a trusted contact.