A new phishing scam targets American Express cardholders

Cybersecurity firm Armorblox discovered a new phishing campaign aimed at American Express customers. Armorblox researchers uncovered a new phishing campaign that is targeting American Express customers. The messages use a malicious attachment and their content attempt to trick cardholders into opening it. The subject of the emails reads “Important Notification About Your Account” in an attempt to urge recipients […]

September 4, 2022

Cybersecurity firm Armorblox discovered a new phishing campaign aimed at American Express customers.

Armorblox researchers uncovered a new phishing campaign that is targeting American Express customers.

The messages use a malicious attachment and their content attempt to trick cardholders into opening it.

The subject of the emails reads “Important Notification About Your Account” in an attempt to urge recipients to open it. Once opened, the email appears as a legitimate email communication from American Express, while the content instructs the cardholder on how to view the secure, encrypted message attached.

“Upon opening the attachment, victims were greeted with a message announcing additional verification requirements for the associated account. Urgency was instilled within the victims through the inclusion of the language, “This is your last chance to confirm it before we suspend it”, and a prompt for victims to complete a one-time verification process that was needed as part of a global update from the American Express team.” reads the analysis published by the Armorblox.

Upon clicking on the link in the message, victims are redirected to a fake American Express login page, which includes the company’s logo and a link to download the American Express app.

The page was crafted to request the victims to enter their user ID and password.

The phishing campaign bypassed native Google Workspace email security controls because it passed both DKIM and SPF email authentication.

Threat actors behind the campaign used a valid domain to send this malicious email, the domain used by the sender received a reputation score of trustworthy and global threat history of zero security events. The phishing email, marked by Google as safe, was delivered to more than 16,000 users’ addresses.

Below are the recommendations provided by Armorblox to identify phishing messages: