ARN provides a weekly wrap of the phishing scams, malware attacks and security breaches impacting organisations across Australia.
This week, two different emails, one purporting to be from Medicare and another from Officeworks, were identified as scams by security vendors and the government.
On 4 July, the Australian Government online safety information page Stay Smart Online was warning Australians about an email scam using the Department of Human Services and Medicare logos.
The phishing email asked recipients to update their electronic funds transfer (EFT) details, which would allow for payments to be received from Medicare.
However, the link led to a fake MyGov page that would eventually ask for recipients account details.
"Email continues to be a popular method for criminals hoping to trick you into handing over your money or personal information," read a statement on the page.
Meanwhile, a fake Officeworks was picked up by cloud-based email management provider Mimecast this week.
The email contained a link prompting recipients to download a malware which appeared to be a a banking trojan via compromised Sharepoint sites.
"This is another example where the trust in well-known brands is being used to socially engineer people into clicking a link in a phishing email," Mimecast principal technical consultant Garrett O'Hara said.
"We hope that end users will see the email doesn’t come from Officeworks. At this time of year phishing campaigns will use branding for well-known online stores given their EOFY [end of year financial] sales.
"Lots of people will be expecting packages so it is easier to fool people. And given we’re into tax return time we can expect to see more of the ‘ATO refund’ emails circulating."
Earlier in the week, HealthEngine revealed it had notified a "small group" of users of a data breach in which identifying information may have been improperly accessed.
The data was accessed through HelathEngine's Practice Recognition System via the company's website.
The breach was made possible due to an error in the way the provider's website operates, which allowed hidden patient feedback information within the code of the webpage to be improperly accessed by third parties.
