Employees of large corporations are being targeted with phishing emails that impersonate the Wells Fargo security team and use innocent-looking calendar invitations as clickbait.
The fraudsters try to get message recipients to click on the invitations, which take them to a malicious website that resembles the Wells Fargo site, according to Abnormal Security, a cybersecurity research firm that says it discovered the attack.
At that site, victims are asked for sensitive information like the username, login, card PIN or number for their personal accounts held at Wells. As of Friday the campaign had targeted about 15,000 to 20,000 people, Abnormal Security said in a June 18 blog post. It’s unclear how many have been duped by the scam.