Breach Disclosure: Intelimost

In March 2019, techcrunch published an article about how the Intelimost spam campaign leaked over 3 Million plain text passwords and email addresses. The spammer had abandoned the server used for conducting the campaign and left the server unsecured, which contained plain text passwords and email addresses of users the spammers had compromised to run their campaign.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

On April 2, 2019 techcrunch reported that there were 3 Million plain text passwords and email addresses leaked from a spam campaign. The email addresses and passwords were used in a targeted spamming campaign where credentials were stolen from users on Intelimost.com. These credentials were used to create convincing spam emails where prior email conversations of the user were replied to by the spammer. These emails contained links to fake but legitimate looking sites and they were injected into the email reply. The spam campaign was so effective in tricking users that it had over 100,000 click throughs. The spammers eventually abandoned the server used for conducting the campaign but left the server unsecured, leaving the passwords and email addresses used in the campaign on the server unencrypted and in plain text format.