Norwegian phishing

A contact sent me an e-mail he’d gotten last night.

It was a phishing attempt, written in English, but for a Norwegian bank:

https://www.dnbnor.no/update-clients/

The actual address under that, was:

http://assist.uta.edu/.update/en/personal/index.html

That’s a hidden folder, and is hard to find on a server, unless you know it’s there, or use ls -lf or say cpanel’s file browser.

The University already removed the files (also included a graphic), and the bank has a notice on their front page, asking customers who fell for it to contact them.

My contact is Norwegian, and immediately thought this was fishy…

Leave a Reply