Usually, if you get a scam email, you'll be able to spot a few things
that are dead giveaways. One possible clue, though certainly not guaranteed,
is that the email address is wrong, either being a lookalike domain, or completely different from
where the email is claiming to be, like a bank email coming from a gmail address.
But every once in a while, hackers figure out how to send a scam email from a legitimate domain.
In the past, I talked about this happening with scammers sending an email from ups.com,
verified checkmark and all. And also, how scammers can send fake PayPal invoices to anyone,
and it actually comes from PayPal.com, and this still can happen to this day.
Well, it happened again. This time, hackers found a clever and convoluted way to send
an email from a Salesforce domain. And honestly, I kind of have to be impressed
they figured out this method, because it involves two tricks, one with Salesforce,
and another with Facebook. And fun fact, this scam was actually first discovered
and caught by today's video sponsor, who I'll talk about later, which is Guardio.
They also did a whole write-up about this, I'll put the link in the description, and that's where
a lot of these screenshots came from. Also, you don't have to worry too much about this one,
because Guardia did report the exploit to Salesforce and Meta, and they were able to
fix and close that loophole, but it's still interesting to hear about and learn from.
Anyway, let's actually get into how this scam plays out. In this example,
what happened was the victim would get an email that claims to be from Meta Platforms,
formerly Facebook, with a Salesforce email address. And it says, account violations
at some domain, case.salesforce.com. And the email basically says "you violated some policy,
and your account is going to be banned, blah blah blah, click this link to fix it."
At the core of it, it's a typical phishing scam, but it can bypass most web email filters, because
it comes from Salesforce, a trusted service. And further, when you go to the link that it has,
it actually does go to apps.facebook.com, further adding legitimacy. And if the victim does click
the link, again, they see a thing about a violation with multiple accounts or whatever.
The first big clue that something is off though, is the interface on the right side,
where it says, "Currently Playing OFootball Soccer Manager". And it shows "related games",
and "Exit to Facebook Gaming". If the user clicks on the "Open a New Case Button" they
see, it will show a fake form to fill out, along with a password entry box.
And if you didn't notice that stuff on the right, it would seem pretty legit. You're on
Facebook.com, so you might assume it is safe to put in your password. But of course it is fake,
and if you haven't guessed already, they're basically using a custom app,
hosted on Facebook as a game, which I'll explain how that works later.
But how did they manage to send an email from that Salesforce domain, which was a
key to bypassing a lot of filters? And it was not just spoofed by the way. Well for context,
Salesforce does have a service where they can send out emails on behalf of customers,
and by customers, I mean companies. Which means that you can use Salesforce to send
out marketing emails and stuff, but it will appear to come from the company's email address.
However, they do of course require that you verify that you actually own the email
address you want things to be sent from, and they do this by sending a verification link.
But in the case of Salesforce itself, it does not offer email addresses you
can send from @Salesforce.com, or at least it's not supposed to.
So being able to send an email from something at Salesforce.com would add
credibility. Now before I explain just how the hackers were able to verify that address,
I have a very relevant sponsor for you today that I mentioned before, Guardio. Guardio is a browser
extension that provides real-time protection from all sorts of threats while browsing the web,
as well as having a mobile app that can alert you about leaks of your info on the dark web.
You can scan this QR code to check that out. As for the browser extension, it blocks malicious
sites using in-house custom developed methods for detecting phishing and malware content,
all before those threats even have a chance to do any harm. There's also download protection
to block malicious files even if you accidentally click to download them,
like from fake sites for popular software, or even malicious game mods.
And on the topic of malicious emails, Guardio also just released
a new cross-platform email protection feature which alerts you in real time
also on your phone if a malicious email bypasses your spam filter,
so you know not to open it. So you can also be safe while checking your email on your phone.
Guardio also has plenty of other features like scanning your other browser extensions
to alert you if there are any disguised malicious extensions installed and neutralizing them. And
one of my other personal favorite features is that it will warn you
if a website's domain has been registered very recently, which is a major red flag.
You can scan your browser for threats for free by visiting Guard.io/ThioJoe and installing the
extension, and also check out the mobile app. You'll get a 7-day free trial to the premium
features such as real-time threat removal, plus 20% off every month for a year. So if you want
a clean and secure browsing experience, again visit Guard.io/ThioJoe, link in the description,
and also check out their affordable premium plan which includes full protection for up to 5 users.
And with all that being said, let's continue. So the scammers must have figured out a way to
verify an email address at salesforce.com, but how did they do this? And even more so,
how did they get that specific one, "account violations",
at the Salesforce domain? Basically, after you sign up for a Salesforce company account,
they will let you create a partially custom and unique email address for receiving emails only.
And any emails sent to that address get converted into a support ticket. So for example, if you have
some kind of "Contact Us" form on your website, you could have that send the info to this unique
email address so it gets added to your Salesforce dashboard or whatever to manage. And the way
this custom email address works is you can put anything before the @ symbol, and then afterwards
it creates a subdomain of salesforce.com which contains a unique hash related to your account.
And the reason this is important is now you can receive emails at that account,
which you can then see as support tickets that get added. But again,
this address is supposed to only be for receiving emails. You're not supposed to
usually be able to send out from it. Except there is that other feature we talked about
that lets you send from any email that you're able to receive the verification link at.
Hmm. So yeah, now you can just go into that email sending feature and put in
that email address it just created for you. And when it sends you the verification link,
you will see it show up as a support ticket and therefore can click it. And
it's important to note that you can choose what name the email address appears from.
And on top of that, there's the fact that you can choose what text is before the @ in the email
address. So it all can look pretty convincing. And funny enough, when Guardia was testing and
trying to reproduce this exploit, they were able to let themselves send from salesforce
at whatever dot salesforce.com, and Gmail even marked their test scam email as important.
Now to clarify, the scammers at this point could have chosen to impersonate any company
they wanted, but they did choose specifically to impersonate Facebook slash Meta for a clever
reason. Let me explain. The scammers are going to obviously need some kind of web page to host
their phishing site on. And while they could just create their own domain and host it there,
that probably would be more likely to get caught by spam filters.
But in this case, the scammers figured out a way to host the phishing page on Facebook. Therefore
it came from a seemingly legitimate email address, and it linked only to a legitimate website,
Facebook. You see, it turns out that Facebook has a legacy feature that allows developers to
create games that get hosted on their own page on Facebook, or more specifically part of a page
called a Frame, but on Facebook nonetheless. Which is exactly what the scammers did here.
But instead of a game, they just put code for a phishing page. And
as for why the name still showed as "OFootball Soccer Manager",
basically Facebook did deprecate this feature back in 2020. However, games
that already existed could stick around and could still update themselves. So I think what likely
happened is either the scammers were able to steal the Facebook account owning that game,
like phishing maybe, or possibly they offered to buy the account from the original owner.
And presumably they were unable to change the name of the game,
which is why it still showed as Football Manager. So how do you protect yourself
against this type of scam where on the surface, seemingly everything is legitimate?
I would say the first clue is going to be to consider the supposed purpose of the email.
There are so many times, often, where a scam email will have a theme of,
"Something bad happened to you!" So if you received any email where your first
reaction is, "Whoa wait, what?" Then I would say set off a "yellow flag",
you might call it. Don't automatically assume it's fake necessarily, but inspect
it carefully using the usual strategies, like carefully checking the "From" address.
And before ever even considering clicking a link, hover over it
to see where that link actually goes, that sort of thing. And if you're still not sure,
one thing you can try is Googling the subject of the email or part of the contents of it,
and see if anyone else has received a similar email, and what they're saying about it.
Or of course, you could always go to the site that the email is claiming to be from,
not by clicking the link, but actually typing it into your browser,
and then contacting customer support through that and asking if it's legit or not. And of
course, another layer of defense is Guardio, who sponsored this video.
They can notify you about malicious emails that may have slipped through into your
inbox. In any case though, hopefully you did find this video interesting
and informative. If you did like it, be sure to give it a thumbs up for
the YouTube algorithm and let me know down in the comments, what you think.
Did you ever get an email like this that seemed completely legit? Were you able
to spot it right away or maybe not? Thanks again to Guardio for sponsoring this video.
Be sure to visit Guard.io/ThioJoe and install the extension and scan
your browser for threats for free. The link is also in the description.
And also check out their mobile app by scanning the QR code. If you want to keep watching,
the next video I'd recommend is one I made a while ago about the ultimate
guide for spotting a spoofed email. I went into incredible detail and a
lot of people have said they liked that one. So I'll put that link right there
you can click on. So thanks so much for watching and I'll see you in the next one. Bye.