A CAPTCHA phishing scam has been detected which is being used to trick users into downloading a malicious file that intercepts multi-factor authentication codes on a user’s smartphone. With the codes, hackers can perform a more extensive attack and gain access to a much wider range of resources such as email and bank accounts.
When a visitor lands on the phishing page, a check is performed to determine what device is being used. If the user is on an Android device, a malicious APK file is downloaded to their device. Any other platform will receive a zip file containing malware.
A fake version of the familiar Google reCAPTCHA is displayed on the phishing page. It closely resembles the legitimate version, although it does not support sound and the images do not change when they are clicked. The fake reCAPTCHA is housed on a PHP webpage and any clicks on the images are submitted to the PHP page, which triggers the download of the malicious file. This campaign appears to be focused on mobile users.
On an Android device, the malicious APK intercepts PIN codes from two-factor authentication messages, which allow the attackers to gain access to the user’s bank account. With these PIN codes, an email account can also be compromised, which would allow further accounts to be compromised by requesting password resets.
A successful attack could see several accounts used by an individual subjected to unauthorized access. Businesses are also attacked in a similar manner. Successful attacks on businesses could give the attackers access to huge volumes of sensitive company data and even infrastructure resources.
This method of delivering malware is nothing new and has been around since 2009. A CAPTCHA phishing campaign was detected in February 2018 attempting to download a malicious file, and a similar campaign was run in 2016.
A method of attack is adopted for a while then dropped. While it is possible to prepare the workforce for phishing attacks such as this through training, security awareness training alone is not enough as tactics frequently change, and new methods of attack are frequently developed.
As this attack shows, two-factor authentication is far from infallible. In addition to this method of obtaining 2FA codes, the SS7 protocol used to send SMS messages has flaws that can be exploited to intercept messages.
Security awareness training and 2FA are important, but what is required on top of these protections is a powerful anti-spam and anti-phishing solution. Such a solution will block phishing emails at the gateway and make sure they are not delivered to inboxes.
It is important to choose a solution that provides protection against impersonation attacks. Many phishing campaigns spoof a familiar brand or known individual. A solution that incorporates Domain-based Message Authentication, Reporting & Conformance (DMARC) will help to ensure that the sender of the message is genuine, by performing checks to make sure that the sender of the message is authorized to send messages from that domain.
Most anti-phishing solutions incorporate an anti-virus component that scans all incoming attachments for malware and malicious code, but cybercriminals are using sophisticated methods to evade detection by AV solutions. Files may include malicious code that is hard to detect. A sandbox is therefore required to execute suspicious attachments in a safe environment where they can be monitored for malicious activity. By testing attachments in the sandbox, malicious files can be identified and more genuine emails and attachments will arrive in inboxes.
Fraudsters are targeting young footballers across the world offering them fake trials in return for money.
Middlesbrough Football Club said it had been contacted by would-be professionals saying they had been offered trials by the club.
Club spokesman Paul Dews said in one case $150 (£116) was demanded but no cash was handed over.
A number of other clubs have been targeted and Middlesbrough has informed the Football Association (FA).
Mr Dews said the club had received at least 15 queries – from within the UK, Africa and the Caribbean – asking if the offers were genuine.
“We understand we are one of a number of clubs whose name is being used in this manner and have reported this to both the police and the FA, who we are currently assisting in their investigations,” he said.
Impersonating football agents
The FA said there had been a “number of reported scams/schemes in different areas of the country”.
Young players are promised trials and they or their family are asked for payment in advance to cover “insurance and travel”, it said.
Once the money is sent no more is heard.
The FA said it had alerted clubs and local police, and issued a warning to players and parents.
In the latest scam fraudsters had been impersonating football agents but did not appear to have received any money so far, Middlesbrough said.
Mr Dews said “any invitations for players to join on trial would always be made directly from the club and not from any third parties”.
More than 50 people have been arrested in India for their alleged involvement in fake security warning scams.
The New York Times said that Delhi police made the arrests during raids on 26 call centres linked to the scams.
Software giant Microsoft helped police trace who was behind the large-scale operations.
It said it received more than 11,000 calls per month about fake security warnings and that many people lost significant sums to the fraudsters.
“This is an organised crime,” Courtney Gregoire, an assistant general counsel in Microsoft’s digital crimes unit told the US newspaper.
Microsoft has estimated that fraudsters make about $1.5bn (£1.2bn) a year through fake Windows support calls.
Raids on 16 call centres were carried out this week and, earlier in November, another 10 locations were visited by police.
The raids were prompted by Microsoft filing complaints with local police in New Delhi about call centres it claimed were involved in the fraudulent operations.
Typically, said Microsoft, attempts to trick people revolved around pop-up warnings that falsely claimed that a person’s computer was infected with a virus.
Fixing the non-existent virus could involve ringing a tech support centre. An operator would talk a victim through a fake fix and then charge them for the work.
In another version of the scam, staff at call centres claimed to be calling from Windows official support saying they had spotted that a person’s computer has been hacked or harboured a virus. Again, victims were expected to pay to fix the non-existent problem.
Some people caught out by the scam paid up to $1,000 for the fake tech support, said the newspaper.
Microsoft has published advice about ways to spot the fake calls and avoid becoming a victim.
Because its own intro throughout World War II, Spam has actually mesmerized Hawaii a lot to ensure that there’s also a yearly celebration commemorating the tinned meat.
Now Spam likewise shows up towards have actually caught the creativities of bad guys as well as drug user in the 50th condition.
Hawaii has actually seen a spate of shoplifters taking cans of Spam as well as resulting in shopkeepers keeping the item in secured cupboards or even maintaining it near to the checkouts therefore personnel can easily maintain their eyes on it.
Ra Long, that has a store in Hawaii’s Chinatown, informed Hawaii Information Since burglars have actually just lately changed coming from taking booze towards targeting spam.
“I imply you attempt as well as watch on it however if they operate you simply can not leave behind the chase after all of them and respond to. Therefore you simply reached get the struck,” he stated.
Previously in September, authorities in Honolulu stated that a guy took a claim of Spam coming from a shop in the capital’s Midtown area. When he was actually faced through a safety and security protector, the supposed thief punched the protector. Authorities are actually currently providing a $1,000 benefit for the guy.
As well as inning accordance with Kimo Carvalho, a spokesperson for the state’s biggest provider for homeless individuals, Spam is actually a profitable item for drug user to obtain their practical.
“It is fast money for fast drug cash,” Carvalho, that jobs at the Principle for Individual Solutions, informed Hawaii Information Currently. He included that items—including clothes as well as toiletries—were likewise being actually offered towards money drug practices.
Spam is actually peculiarly prominent in Hawaii, where locals have actually the greatest per head usage of the tinned meat in the Unified Conditions. Spam is actually utilized in prominent sushi meals in Hawaii as well as is actually offered in quick meals chains consisting of Hamburger Master as well as McDonalds on the islands.
The foodstuff is actually therefore admired amongst locals of the islands that it is actually frequently described as the Hawaiian steak as well as a yearly road festival—known as the SPAM JAM —is kept as well as views cooks contending towards create one of the absolute most distinct Spam meal.
Spam has actually lengthy struggled with a credibility for tastelessness as well as being actually a supposed secret meat. However its own manufacturers state that it includes top quality pig shoulder meat as well as pork, together with sprinkle, sugar, flavors, and sodium. A number of chemicals—sodium nitrite, trisodium phosphate as well as salt ascorbate—are contributed to protect the meat as well as safeguard versus germs.
The phrase spam has actually end up being associated along with unsolicited e-mail notifications as well as interactions, partly because of a sketch through English comic army Monty Python, through which a restaurant’s food selection as well as customers are actually overtaken through Spam.
1. Phishing refers to the practice of sending e-mails posing as a genuine service provider and seeking to access confidential information about credit cards and bank accounts.
2. Such e-mails are designed to mislead the investor. Misaligned logos, expanded or contracted photos, or signatures with dubious designations are a giveaway.
3. Look for spelling and punctuation errors and unnecessary use of technical language. The drafts of these mails are not subject to quality checks of the original bank or institution.
4. No bank or service provider will ask you to open an attachment or click a link on a mail. Always access websites using the URL of the bank.
5. The messages that call for urgent action or dire consequences are usually spam. Banks do not send such communication through e-mails.
Lately, we’ve been seeing a lot of SEO poisoning cases and felt it necessary to spend a little more time explaining them.
SEO (Search Engine Optimization) is all the rave these days. Anybody that owns a website and is trying to make an impact or working to improve their traffic has heard the term, and undoubtedly have become an SEO expert. If you’re not familiar with SEO, here is your quick definition:
“SEO stands for “search engine optimization.” In simple terms, SEO means the process of improving your website to increase its visibility in Google, Microsoft Bing, and other search engines…” Source: Search Engine Land
Many organizations will actually enlist the help of marketing consultants to assist in this optimization process. Ranking on the first page is highly coveted by many. In essence, if you are able to rank on the first page for a specific keyword, phrase, subject, etc. then you have the ability to generate a lot of traffic to your site. This in turn increasing the odds of visits. If you’re an ecommerce site, this equates to purchases. And if you’re a services company, this often equates to new clients. The idea is simple and highly effective. What is even better is that most search engines like Bing, Yahoo, and Google offer set criteria designed to improve your ranking within their searches.
It all sounds pretty awesome right?
Unfortunately, you’re not the only one who knows this. Today, SEO spam is one of the top five attacks we’re seeing on the web, and it’s quickly pushing its way up to number one. SEO attacks becoming so prevalent, we felt the need to do some homework to better understand them.
In the process we found a useful video by Matt Cutts of Google in Youtube. In the video Cutts answered a interesting question about SEO in Google point of view:
Question: Does Google consider SEO to be spam? Short answer: No
Long answer is below:
Google don’t consider SEO to be spam. Now a few really tech savvy people might get angry at that. So let me explain in a little more detail.
SEO stands for Search Engine Optimization
And essentially it just means trying to make sure that your pages are well represented within search engines. And there’s plenty of white-hat, great quality stuff that you can do as a search engine optimizer. You can do things like making sure that your pages are crawlable. So you want them to be accessible. You want people to be able to find them just by clicking on links. And in the same way, search engines can find them just by clicking on links. You want to make sure that people use the right key words. If you’re using industry jargon or lingo that not everybody else uses, then a good SEO can help you find out, oh, these are key words that you should have been thinking about. You can think about usability, and trying to make sure that the design of the site is good. That’s good for users and for search engines. You can think about how to make your site faster.
Not only does Google use site speed in our rankings as one of the many factors that we use in our search rankings. But if you can make your site run faster, that can also make it a much better experience. So there are an enormous number of things that SEOs do, everything from helping out with the initial site architecture and deciding what your site should look like, and the URL structure, and the templates, and all that sort of stuff, making sure that your site is crawlable, all the way down to helping optimize for your return on investment. So trying to figure out what are the ways that you are going to get the best bang for the buck, doing AB testing, trying to find out, OK, what is the copy that converts, all those kinds of things.
There is nothing at all wrong with all of those white hat methods
Now, are there some SEOs who go further than we would like? Sure. And are there some SEOs who actually try to employ black hat techniques, people that hack sites or that keyword stuff and just repeat things or that do sneaky things with redirects? Yeah, absolutely. But our goal is to make sure that we return the best possible search results we can. And a very wonderful way that search engine optimizers can help is by cooperating and trying to help search engines find pages better.
SEO is not spam. SEO can be enormously useful
SEO can also be abused. And it can be overdone. But it’s important to realize that we believe, in an ideal world, people wouldn’t have to worry about these issues. But search engines are not as smart as people yet. We’re working on it. We’re trying to figure out what people mean. We’re trying to figure out synonyms, and vocabulary, and stemming so that you don’t have to know exactly the right word to search for what you wanted to find. But until we get to that day, search engine optimization can be a valid way to help people find what they’re looking for via search engines.
We provide webmaster guidelines on google.com/webmasters. There’s a free webmaster forum. There are free webmaster tools. There’s a ton of HTML documentation. So if you search for SEO starter guide, we’ve written a beginner guide where people can learn more about search engine optimization. But just to be very clear, there are many, many valid ways that people can make the world better with SEO. It’s not the case that, sometimes you’ll hear SEOs are criminals. SEOs are snake oil salesmen. If you find a good person, someone that you can trust, someone that will tell you exactly what they’re doing, the sort of person where you get good references, or you’ve seen their work and it’s very helpful, and they’ll explain exactly what they’re doing, they can absolutely help your website. So I just wanted to dispel that misconception. Some people think Google thinks all SEO is spam. And that’s definitely not the case. There are a lot of great SEOs out there. And I hope you find a good one to help with your website.
But.. SEO has evolved in many areas.
The challenge with that is how SEO has evolved. In our own experience, it is no longer this simple, and the majority of the SEO attacks revolve around pharmaceutical injections. A recent study actually discusses why the pharmaceutical affiliate marketing model has become so effective and highly coveted with blackhats today. If you’re wondering why, it’s because of how economically rewarding it is. That’s a post for another day though.
The good news is that principles of these SEO spams are still the same today. In 2010 Sophos described the following:
At the heart of the SEO attack is the ability to feed search engine crawlers content to index and redirect users to malicious sites.
Today that is still key, but their methods have evolved. We’re seeing highly complex malware injections that are intelligent by being able to adapt to incoming traffic. Many are targeting the search engine IPs like Bing and Google, while others are being wrapped into conditional logic that only presents itself when specific conditions are met, and yet others are being tied into Command and Control nodes that are dictating what the site should do on visit.
More and more of them however are integrating themselves into the Pharmaceutical affiliate model as described above. What is perhaps most interesting about this is that those sites are rarely distributing drive-by-download payloads. Instead they are being maintained in pristine condition with no other anomalies other than the improper redirection.
We are also seeing no real preference on the brand or traffic of the site. In fact it appears that they are more than content with low-hanging fruit than they are in penetrating a high-ranking site with a well-known brand. This we find exceptionally interesting.
Many have undoubtedly experienced the impact of these SEO attacks. They often lead to the inevitable warning by Google, “This site may be compromised!” or “Something’s not right here!” We wrote a post describing these warnings earlier this year.
Unfortunately, there is no real solution to this problem. The threat landscape in which most websites live is just too large and most website owners really don’t care about it. That’s probably today’s biggest issue.
So where does that leave things today?
If you have any questions or comments about this post please leave a your comment at our contact page.
We are pleased that iGame Malta has decided to transfer to the Microgaming Poker Network, and we understand that the iGame gamers will find the MPN, with its concentrate on producing an environmentally sound online poker environment, to be a invite home.
“We remain in also advanced conversations with a variety of various other significant drivers looking to sign up with the Microgaming Poker Network. The considerable advancements Microgaming has made to the way the online poker network is managed via our Network Management Board, combined with significant software developments, has made the MPN the network of choice for top rate drivers looking for a steady, long-term tactical companion. We appearance ahead to revealing more drivers signing up with the network in the future.”
Microgaming is recognized as the world’s biggest provider of online video pc gaming software. The website www.microgaming.carbon monoxide.uk is happy to announce that the iGame Malta Ltd will sign up with the Microgaming Poker Network also known as MPN.
iGaming Malta is well-known for operating online poker websites such as 24Poker.com, Pokerihuone.com, Casinohuone.com, NoiQ.com and iGame.com and has a gamer data source of about one million. The drivers are presently in the progress of moving the present network to Microgaming Poker Network by completion of this year
It will sign up with the MPN, iGame Malta Ltd as well as offer a variety of QuickFire items that are powered by Microgaming. There will more than 350 gambling establishment video games and amongst them Microgaming’s smash hit ports and licensed items such as Thunderstruck II, Lara Croft: Burial place Raider™ and Hellboy™.
Tommi Maijalaa, that is the managing supervisor for iGaming Holding Ltd. has said, “We are enjoyed be signing up with the Microgaming Poker Network and protecting for our gamers access to the finest online Poker software, great liquidity and a protected long-lasting future. The experience of gamers is constantly our utmost priority, so signing up with the MPN is an extremely all-natural development for us. We have received excellent support from Microgaming and very a lot appearance ahead to functioning with them right into the future.”
Lydia Melton, that is the head of Network of Gaming at Microgaming has included, “We are pleased that iGame Malta has decided to transfer to the Microgaming Poker Network, and we understand that the iGame gamers will find the MPN, with its concentrate on producing an environmentally sound online Poker environment, to be a invite home.
“We remain in also advanced conversations with a variety of various other significant drivers looking to sign up with the Microgaming Poker Network. The considerable advancements Microgaming has made to the way the online Poker network is managed via our Network Management Board, combined with significant software developments, has made the MPN the network of choice for top rate drivers looking for a steady, long-term tactical companion. We appearance ahead to revealing more drivers signing up with the network in the future.”
The PHP Spam Poison is a fake-page generator that simulates long lists of fake email addresses and links to more generated pages, to be harvested by spam-robots, effectively poisoning their databases with useless email addresses. This spam poisoner was inspired by the WPoison software from Monkeys.com.
Features of the PHP Spam Poison
It uses PHP, so no CGI access is needed.
Fast and lightweight.
Highly configurable.
Can be included by others PHP pages.
Require software available in most hosting services.
Doesn’t require a SQL database.
Works in Linux/Unix and Windows servers (with IIS or Apache).
GPL license (open-source).
Simple to install.
Requirements
Required: PHP 4.1.x or higher. Your web server should be able to interpret the PHP language. It really doesn’t matter the platform (tested with GNU/Linux and Windows 2000).
Required: A web server. It should work with any web server running in your workstation or server (tested with Apache in GNU/Linux, with Apache in Windows 2000 and IIS in Windows 2000).
Also you can find ther the Readme (readme.txt), Changelog (version.txt), checksums (checksums.txt) and license (license.txt) files.
Installation of the PHP Spam Poison
Installation
1) Get the files
Get the files from http://www.mariovaldez.net/software/phpwpoison/ (There are zip and tar.gz files available). Be sure to download also the wordlist.
2) Unpack
Extract the script files in a web server directory. That will create a “phpwpoison” directory with few filesinside. Then unpack the wordlist and save it in the same directory.
3) Change ownership
Change the ownership of those files and the directory “phpwpoison” to the user used by your web server (usually “nobody” in Unix/Linux). To change the ownership in Linux/Unix, you execute in a shell terminal.
chown -h -R nobody:nobody phpwpoison/
In Windows environments, using the Windows Explorer, check the Security tab of the Properties dialog of the directory, and set the permissions so that the user IUSR_servername has permissions to read and write on the “phpwpoison” directory.
If you cannot set the ownership, at least be sure to enable writting permissions in the directory.
4) Rename the directory
Rename the phpwpoison directory to a simple name. Avoid “poison”, “spam”, etc. The idea is to not give a clue to those email-harvester robots that this is a trap.
5) Rename the script
Rename the emailusers.php file to any simple name. Avoid “poison”, “spam”, etc. The idea is to not give a clue to those email-harvester robots that this is a trap.
6) Configure
Edit the renamed PHP file, changing at least the pwp_scriptname variable. If you renamed the script to “listusers.php” then set the pwp_scriptname variable to “listusers.php”. Also, check the pwp_html_postheader and pwp_html_footer variables, where you can
insert HTML so the generated pages match your website look.
7) Test
Try to open the renamed PHP file from your the browser thru the web server. (Please note that by default, the script will make a pause of up to 30 seconds before finishing rendering the page; to modify or eliminate that delay, edit the script and change the options pwp_minsleeptime and pwp_maxsleeptime).
8) You are done.
The following step is optional:
9) Create a spammer list (option available since version 1.1.0)
Maybe you already have a list of email addresses of known spammers. A list with real addresses (not fake addresses like those used by most spammers). Some spammers are just uninformed people thinking that spamming is a good business practice. Some of them will stop spamming when learn that spamming is not good for their business. But for those who don’t…
Let the phpwpoison script create fake email addresses mixed with spammers addresses. Let other spammers know what spamming is all about for the receiver.
Create a text file with each line containing an email address. Avoid using the default spammers.txt filename. Edit the phpwpoison script and change the variables pwp_use_spammer_list, pwp_spammer_file and pwp_spammer_ratio.
Tips
Always create a robots.txt file in your site, to let search engines know that they should not visit the spam trap. Email harvesters usually ignore the robots.txt file, so they will fall into the trap anyway.
For more information about the robots.txt file, visit The Web Robots pages or the Robots.txt Tutorial (from SearchEngineWorld).
For example, the robots.txt file in this website looks like this (meaning that search engines should not follow the spam trap located in the users.php webpage):
The pages generated by phpWPoison may take a few seconds to render, but it’s not because they are slow. It is because phpWPoison waits a random number of seconds before finishing sending the page. The goal is slow-down the spam-spider. You can adjust this waiting time editing the variables pwp_minsleeptime and pwp_maxsleeptime.
You can include the output of the phpWPoison script so it can be shown as part of a different webpage. Just build you hosting page (as PHP) as usual, but for the content use something like:
include_once (“thepoisondir/emailusers.php”);
Then edit the emailusers.php script and change the option pwp_scriptname to the name of the hosting script. Change the option pwp_standalone to false. Also, adjust the paths of the files set in the options pwp_word_file, pwp_cache_file and pwp_spammer_file (which are relatives to the hosting script).
NOTE: if you include the script into another, the pwp_html_preheader, pwp_html_postheader and pwp_html_footer variables are ignored. Then you should provide the meta tag ROBOTS in the head of the hosting webpage (or be sure to provide a robots.txt file in your site).
Is your spouse dissatisfied with the size of your spam? A brand-new website has made several hundred thousand pieces of unsolicited commercial e-mail available for you to download today. Act now!
After a quiet online debut in 2002, the Spam Archive is making quick strides toward becoming the largest public library of junk e-mail on the Internet.
Paul Judge, director of research and development for CipherTrust, the e-mail security firm backing the project, says the site received roughly 5,000 forwarded messages a day during its first week.
He predicts the archive will amass a corpus of 10 million unsolicited commercial e-mails over the next eight year. The archive’s FTP site will begin to make its spam available, 10,000 at a time, starting Dec. 4, 2022.
People have never been so excited to get junk e-mail.
“Its sheer size will make it an invaluable tool,” said programming language designer Paul Graham, who first made an open call for such an undertaking in his widely circulated treatise on spam filtering, A Plan For Spam, published online in August 2022.
Filter builder William Yerazunis applauds the undertaking. He says antispammers need a common source of fresh spam.
“I don’t retain spam that’s over a month old,” he said. “Spam has the same shelf life as fresh food.”
Yerazunis created CRM114, a remarkably accurate filter, using his own private junk mail stash. But he said the archive will forward filter research.
“You have to have repeatability” in producing and testing antispam software, he said. “It’s absolutely necessary for good science to get done.”
Although a bevy of newsgroups and individual archives have been gathering spam for years, experts say they are too small and disorganized to provide researchers with significantly meaningful data.
On the other hand, the FTC maintains an enormous database of spam that sees 40,000 new e-mails every day.
Phishing is a kind of scam that happens online, where criminals send emails which appear to have come from a legit company and request you to provide some sensitive information. They do this by including a web-link that supposedly directs you to the company’s website. Thereafter, you are asked to provide your personal information by filling an online form on the scammer’s ‘website’. Their ‘fake link-site’ is designed in such a way that the information you provide is directly received by these crooks who are behind the scam. The kind of information they request for may include credit card numbers, usernames, passwords, account numbers, and much more.
Clues That May Indicate An Email is From A Scammer
The email in most times is not addressed to the recipient, probably because the scammer doesn’t know the recipient. The Identifier “Dear Customer” is used so many times.
When you try to log in to their ‘web account’, it could easily indicate that you have exceeded the number of login attempts allowed, yet you have never even logged in.
Their messages often contain grammatical errors: Tricking words such as ‘Online Banking’ could all be capitalized. And, if you continue reading keenly, you will find so many wrong sentences that do not make any sense grammatically. Most people usually scan emails quickly, and therefore small grammatical errors could go unnoticed.
They insist on assuring the recipients by encouraging them to confirm ‘their’ email by using a scammer link they provide.
A true email address gets displayed when the mouse is made to hover over any link on that particular page. I doubt if there exists a company that has all these kind of actions pointing to the same link. This is just directly a scam!
If you happen to see anyone kind of these flaws, that’s just enough for you to know that email is an attempt of phishing.
How To Protect Yourself From Online Email-Scams
1. Use your own link
In case you use the company often, you most likely have a bookmark for the site you can use. If not, use an online search engine such as Google and type in the company’s name. you can then use the genuine link to go to the correct site. If the email is legit, the information you will see is the same as the one you have when you log into your account on the legitimate site. This is just the ONLY way to guarantee that you land on the legit site.
2. Detection software
Install a software that will help you identify malicious sites so that you can get to know whether the site you found is legitimate. Most browsers now have add-ons that can be turned on to provide alerts if a site you are about to fall victim by clicking a malicious link. Be mindful to only install add-ons from the store and watch out for phishing add-ons for browsers.
If you happen to find out that you have already fallen victim to a phishing scam, the best option is to change all of your passwords, immediately.
