A new phishing scam is exploiting fake ‘Cloud Storage Full’ alerts to trick users into providing credit card and personal information. Criminals send personalized messages claiming photos and videos will be deleted unless users pay a fee. Trend Micro reports a 531% spike in such scams from September to October, highlighting the increasing threat.
The scam targets smartphones, sending fake ‘Cloud Storage Full’ or ‘photo deletion’ alerts that urge users to upgrade their storage. These messages mimic major cloud services, creating an urgent and real-looking scenario. Once users click the link, they are directed to a fake website that appears to be a cloud storage dashboard, encouraging them to pay a small fee to prevent data loss. The fake websites often include elements like simulated cloud storage layouts and progress bars, countdown timers, and warnings about imminent data deletion.
Jon Clay, VP of threat intelligence at Trend Micro, emphasized the effectiveness of this scam’s emotional manipulation. He warned that scammers are targeting users who may be more anxious about losing precious memories. The scam’s success relies on fear and urgency, prompting users to act without thorough verification. Trend Micro analysts report a significant increase in such scam activities from September to October, underscoring the need for heightened awareness and proactive security measures.
Scammers follow a predictable pattern, starting with personalized SMS or iMessage alerts that include the user’s name and fake photo counts. These messages are designed to boost credibility and trigger panic. Victims receive urgent warnings and a short link leading to a malicious .info domain. Upon clicking, users are directed to a convincing fake website that mirrors popular cloud storage platforms.
Once victims enter credit card or PayPal details, scammers harvest the data instantly, potentially leading to unauthorized purchases, credential stuffing, or resale on dark web markets. Some victims receive fake receipt emails to make the charge look legitimate, further deceiving them. Trend Micro’s analysis outlines the scam’s progression, from the initial message to the final theft, with detailed examples of fake dashboards and false warnings.
Victims are advised to verify alerts directly through official apps or websites to avoid falling prey to these scams. Experts recommend using strong antivirus software, enabling multi-factor authentication, and regularly reviewing account statements to detect any suspicious activity. Limiting the personal information available online through data removal services can also reduce the risk of targeted attacks.
The rapid spread of this scam highlights the growing sophistication of cybercriminal tactics and the importance of user vigilance. Users are urged to remain cautious of unsolicited messages and to question surprise warnings about data loss. A few seconds of verification through official channels can save users from significant financial and identity theft risks. As this scam demonstrates, emotional manipulation remains a powerful tool for cybercriminals, emphasizing the need for education and proactive security measures to protect personal and financial data.