The US FINRA warns US brokerage firms and brokers of an ongoing phishing campaign impersonating its representatives to steal sensitive info.
The US Financial Industry Regulatory Authority (FINRA) is warning US brokerage firms and brokers of an ongoing phishing campaign. Threat actors are impersonating FINRA officials and are using the threat of penalties to trick victims recipients into providing sensitive information.
The regulator reported that threat actors behind the campaign are using multiple domains (i.e., finrar-reporting[.]org, finpro-finrar[.]org, gateway2-finra[.]org) impersonating the legitimate websites
“FINRA warns member firms of an ongoing phishing campaign that involves fraudulent emails (see sample in Appendix) purporting to be from FINRA” reads the alert published by the authority. “and using one of at least three imposter FINRA domain names:
- “@finrar-reporting.org”
- “@Finpro-finrar.org”
- “@gateway2-finra.org”
The email asks the recipient to click a link to “view request” and provide information to “complete” that request, noting that “late submission may attract penalties.”
The above domains were registered recently, on August 12, through Hosting Concepts B.V. and NameCheap registrars.
Recipients that have clicked on any link or image included in the messages are recommended to immediately notify the appropriate individuals in their organizations.
FINRA recommends brokerage firms and brokers to verify the legitimacy of any suspicious email prior to opening any attachments or clicking on embedded links.
The regulator already requested to the relevant Internet domain registrars to suspend the domain names employed in the attacks.
“For more information, firms should review the resources provided on US Financial Industry Regulatory Authority’s Cybersecurity Topic Page, including the Phishing section of our Report on Cybersecurity Practices – 2018,” the authority adds.
Follow me on Twitter: @securityaffairs and Facebook
Pierluigi Paganini
International Editor-in-Chief
Cyber Defense Magazine
