Phishing campaign impersonating SA Government senior executives

Attackers gather information about agency executives and employees, in particular new employees, from LinkedIn and craft emails, WhatsApp and SMS messages to employees that appear as though they have been sent from an agency executive or senior executives.

The campaign attempts to have the employee respond with contact details and information about the agency.

Tips to identify and protect yourself against phishing:

• Remain vigilant when receiving emails, SMS and WhatsApp messages
• do not respond to an email, SMS or WhatsApp message that is unexpected or looks suspicious
• check the message for spelling errors, incorrect grammar, high urgency, or generic wording such as ‘This is the CEO’
• be aware of the information you post on professional social media sites, particularly when starting a new role. Attackers can utilise this information to craft their phishing campaigns
• set all social media accounts to private to ensure only those approved can see your information
• turn multi-factor authentication (MFA) on for your online accounts, where applicable and set strong passwords
• Report unexpected and suspicious messages to your ICT Service Desk
• Once reported, block the number/sender and delete the message.

Further Information

For more information on how to protect yourself online, visit:

• The Australian Cyber Security Centre (ACSC) - how to spot a phishing email: Know how to spot phishing (scam) messages | Cyber.gov.au
• ACSC’s step-by-step guides on how to secure various online accounts such as Facebook, LinkedIn, and WhatsApp: Step-by-step guides | Cyber.gov.au

Examples:

Below is a list of subject lines linked to the phishing campaign:

• <Blank>
• Available ?
• ERRAND
• ON DESK ?
• URGENT

Below is a screenshot of an email linked to the phishing campaign: