The NJCCIC has recently identified an email campaign impersonating ZoomInfo, a legitimate business intelligence platform. The message, presented as a "Personal Information Notice," resembles standard data privacy disclosures, such as GDPR or CCPA notices. It informs recipients that their professional data is being collected, processed, and shared with third-party B2B customers.
Analysis indicates that the sender’s domain was registered just 104 days before the email was sent, a likely indicator of phishing. The email contains suspicious links that embed the recipient's email address in the URLs. This pattern is often used in phishing to track or target recipients.
To prompt a response, the email directs recipients to visit a "Trust Center" or click embedded links to opt out, access, or delete their profile. Rather than leading to legitimate corporate domains, the embedded hyperlinks pass through tracking and redirection domains and are wrapped by URL defense scanners, obscuring the links’ ultimate destinations. These phishing attempts can enable threat actors to obtain personally identifiable information (PII), account credentials, and financial information.
Recommendations
- Exercise caution with communications from known senders or legitimate platforms.
- Confirm requests from senders via contact information obtained from verified and official sources before taking action, such as clicking on links or opening attachments.
- Navigate directly to legitimate websites and verify before submitting account credentials, providing personal or financial information, or downloading files.
- Enable MFA and keep systems and browsers up to date.
- If sensitive information was entered, change passwords for compromised accounts, monitor for unauthorized activity, and review the Identity Theft and Compromised PII NJCCIC Informational Report for additional recommendations and resources, including credit freezes.