UK visa sponsor licence holders are being targeted in a new phishing campaign which uses Home Office branding.

Specifically, organisations that hold a UK visa sponsor licence and partake in the government’s Sponsorship Management System (SMS), which is used by sponsors of worker, temporary worker, student, and child visas to manage sponsorship certificates and report any changes to sponsored people.

The phishing campaign was uncovered by the threat research team at Mimecast, which identified fraudulent emails that used Home Office logos and closely mimic official Home Office emails. The messages appear to be urgent, directing victims to a fake login page to steal their credentials.

Mimecast found that these URLs are captcha-gated, which then direct users to the phishing pages that appear to be direct copies of genuine UK Home Office pages, with exact copying of the HTML.

Once the SMS credentials are stolen, threat actors were found to take a number of methods to monetise the theft. This ranges from selling compromised accounts on the dark web, facilitating fraudulent issues of sponsorship certificates, or extortion schemes on targeted organisations.

Mimecast found that the most lucrative scheme was the creation of fake job offers and visa sponsorship schemes. Threat actors charged victims between £15,000 to £20,000 for fake job opportunities by leveraging compromised sponsor accounts to create fake visa documents to support immigration scheme scams.

“We are aware of sponsors who have been targeted by these phishing scams and an unfortunate few who have had their systems breached,” Natasha Chell, partner and head of risk and compliance at Laura Devine Immigration said.

Recommended reading

• AI-Driven Phishing and Ransomware Targeting Smaller Firms
• AI Ushering in A “Digital Divide” in Cybersecurity, NCSC Warns
• Cyber-attacks A “Wake-up Call” to Retail Sector

“As gatekeepers of the sponsorship system, sponsors need to protect their Home Office online accounts by having robust IT practices, regular training for Key Personnel who have access to the accounts and they should always contact the official Home Office channels to verify any suspicious requests.”

Mimecast researchers have said that this campaign is active, and has released a number of indicators of compromise and malicious URLs associated with the phishing scheme.

Researchers suggested deploying advanced email security capabilities, and establishing multi-factor authentication for all SMS systems, as well as conducting user awareness training to avoid the fallout of targeted phishing campaigns.