Tech support scammers have hijacked search results for popular websites like Apple, Bank of America, Facebook, HP, Microsoft, Netflix, and PayPal. The scammers replaced legitimate customer support phone numbers with their own numbers to redirect customers looking for help.
The scam was spotted by Malwarebytes’ senior director of research, Jérôme Segura. It begins with the scammers paying for a sponsored ad on Google, impersonating a popular brand. Usually, such fake ads redirect users to entirely fake websites. In this particular scam, the website is legitimate, with the browser address bar also showing the legitimate site’s URL. However, the information a visitor sees on the page is fake, as the scammers have poisoned the search results to display their phone numbers in what resembles an official search result.
Depending on the site, the exact modus operandi of the scam can differ. A Malwarebytes report on the scam claims that scammers pose as the brand and try to get the victim to hand over their personal data or card details in the case of Bank of America and PayPal websites. It also operates differently based on how the company’s legitimate website functions. For example, in the case of Netflix, attackers are able to get away with the scam because Netflix’s search functionality “blindly reflects whatever users put in the search query parameter without proper sanitization or validation.”
The scam is highly effective because the user sees the legitimate URL and website in their browser, and the fake numbers appear to resemble official search results. Malwarebytes has dubbed this a “search parameter injection attack,” as scammers are crafting malicious URLs that embed their fake numbers into a genuine site’s search functionality.
The most obvious tells for such an attack are a phone number in the URL and encoded characters like %20 (space) and %2B (+ sign) written along with the phone numbers. If a website starts showing search results before you start typing, or is using urgent, call-to-action language to urge you to call a number—indicating potentially scammy phone numbers.
In the News: Novel Linux flaw lets attackers get root access
