“Infosystems Jet” revealed phishing campaign against MAX messenger users
By ForGeeks
Jet Infosystems has detected an active phishing campaign targeting MAX messenger users. Experts from Jet’s CSIRT division discovered the spread of fake sites imitating the interface of the official application in order to steal personal data and gain access to accounts.
According to analysts, fraudsters use domains similar in spelling to real messenger addresses – among them max11.online, max1.online, oneme.ru and others. Phishing resources completely copy the visual design of the original site, including logos, favicons and interface elements. Links to fake pages are distributed through mailing lists and search engine ads, which increases the likelihood that a user will mistake the fake site for an official one.
After gaining access to a MAX account, attackers can view correspondence, download sent and received files, copy contacts, and use the information to blackmail or discredit a user. In some cases, it is possible to spoof the account owner’s identity using dipfakes.
“We recommend that MAX messenger users be extra vigilant, do not click on suspicious links, carefully check the sender’s address, and do not enter their credentials on unfamiliar sites. If you suspect that your account has been compromised, you should immediately go to «Privacy» section in the application settings and log out of all active sessions and contact MAX messenger support,” said Ivan Volkovsky, senior analyst at Jet CSIRT.
“We recommend that MAX users be extra vigilant,” said Ivan Volkovsky, senior analyst at Jet CSIRT.
Jet Infosystems emphasizes that regular monitoring of external digital threats allows it to quickly identify new attack vectors and warn users about potential risks.
The Jet Infosystems revealed a phishing campaign against MAX messenger users was first published on ITZine.ru.
