New Netflix phishing campaign sees hackers targeting business emails to steal your credit card data

Netflix users beware — a new phishing scam targeting users of the popular streaming app has been spotted by security experts. The cybercriminals behind the campaign are targeting users' personal as well as business emails, in hopes of harvesting their personal and corporate credentials.

The phishing campaign also tricks users into divulging their credit card data, which can then be used by the scammers to steal money. The stolen credentials can be used by the cybercriminals to access other accounts, in case victims have reused passwords. The stolen data could also likely end up for sale on the dark web.

Security experts at PhishMe, who uncovered the recent Netflix phishing campaign, say that the cybercriminals operating this scam have also been targeting customers of Wells Fargo, Comcast Chase Bank and TD Bank since June. The cybercriminals have been using the same email address (associationpresident3 at gmail dot com) in five different phishing toolkits.

The cyebrcriminals have been sending out a phishing email, which purports to be coming from Netflix, requesting users to update their account details. Targeting corporate emails may be a clever move on the attackers' part because typically, people try and handle minor issues as quickly as possible.

"The Netflix phish works to trick those busy people into giving up login information," PhishMe researchers said in a blog. "The attacker hopes that you reuse the same password for your personal email account or, if the attacker is very lucky, for your work email account. In either case, they can now reset passwords for various other online services — banking, healthcare, social media — to pivot and carry their attack forward."

It is still uncertain as to how many people may already have fallen victim to this phishing campaign. IBTimes UK has reached out to PhishMe for further clarity on the issue and is awaiting a response.