Cyber criminals use phishing emails where they impersonate a third party that may have a credible reason for interacting with your bank, such as a tax department.Then the victims are attracted to a landing page via spam where they are asked to choose their bank from a selection. Then a fake login page is shown for that bank. This increases the chance of a Phisher matching a bank to a potential victim.

The imitation of emails was used in the ongoing attack and they looked practically the same as many preceding HMRC phishing email. The content within the email body was being served directly from the M86 Security Labs website so the victims were less likely to have suspicion.

The victim is taken to an HMRC when he clicks on the image in the phishing email. This initially induces the victim to enter their email address, full name and date of birth, before a subsequent page asks for even more information, including the victim’s postal address and card details.

Netcraft blocked 1,150 HMRC phishing sites last month alone, and particulary found one hosted under the trusted gov.uk domain in 2009.According to Netcraft they playfully embedded the image in their poisoned messages to make them look authentic. They could just run the scam by including that URL in their messages.

TrustWave seems to have dislodged the image on the day Netcraft stated the problem.

Netcraft figured out that it has caught 1,150 attempts to phish HMRC in February alone, so must also feel it has the potency to stop phishers abusing the image it now hosts.