Discover the latest malvertising campaign targeting Lowe’s employees. Learn how the scam works, combining fake ads with phishing pages, and get essential safety tips to protect yourself and your colleagues from this online threat.
A Sneaky Online Threat
Lowe’s employees, watch out! A malicious advertising, or “malvertising,” campaign has been targeting your community through Google ads. This scam combines fake ads with phishing pages, a recipe for disaster, to trick unsuspecting users into giving up their login credentials. It’s a serious threat that requires your attention and action. So, let’s dive into the details and explore ways to protect yourself and your colleagues.
The Malvertising Campaign Unveiled
- Targeted Searches: In mid-August, a malicious campaign was identified, specifically aimed at Lowe’s employees. Those who searched for “myloweslife,” hoping to access the company’s employee portal, became potential victims.
- Fake Ads & Phishing Pages: Fraudulent ads linked to a replica of the My Lowe’s Life employee portal. Unsuspecting employees, trusting Google Search to direct them to the right site, unknowingly landed on a phishing page.
- Stealing Credentials: The phishing page, an exact copy of the real portal, prompted users for their Sales Number and Password. After providing this sensitive information, victims were redirected to the actual MyLowesLife website, where they were asked to log in again. This could be dismissed as a system glitch, allowing the scam to succeed.
- Multiple Advertiser Accounts: Malwarebytes’ Senior Director of Threat Research, Jerome Segura, uncovered two different advertiser accounts impersonating My Lowe’s Life. One search result even displayed three malicious ads, each using slightly different lookalike URLs, making them hard to distinguish from the real thing.
How to Stay Safe and Protect Yourself
- Beware of Unfamiliar Ads: It’s uncommon to see ads for an internal HR portal. If you notice ads related to My Lowe’s Life, be cautious. Report them to the IT department and refrain from clicking.
- Bookmark the Official Portal: Instead of relying on search engines, bookmark the official My Lowe’s Life portal in your browser. This ensures you always access the legitimate site and reduces the risk of landing on phishing pages.
- Verify the Website’s Security: Before entering any sensitive information, check for a secure connection. Look for the padlock icon in the address bar, indicating the site is encrypted and your data is transmitted securely.
- Report Suspicious Activity: If you come across suspicious websites or emails that resemble the My Lowe’s Life portal, report them immediately to the IT department or cybersecurity team. Your vigilance can help protect your colleagues.
- Stay Alert and Informed: Keep yourself updated through the company’s official channels and security bulletins. Stay alert for any new developments or variations of this scam. Knowledge is power in the fight against cyber threats.
Conclusion: Stay Vigilant and Protect Your Digital Life
This malicious campaign targeting Lowe’s employees serves as a stark reminder that cyber threats are constantly evolving and targeting unsuspecting users. By understanding the tactics employed in this scam, you can better protect yourself and your colleagues. Stay vigilant, follow the provided safety tips, and remember to treat your login credentials like the valuable assets they are. Together, we can thwart these attacks and safeguard our digital lives.
Stay safe out there, Lowe’s family!
