(Credit: Fake Starlink login page)
Scammers are going out of their way to target Starlink subscribers with fake email and login pages that try to trick people into providing their account passwords, credit card details, and even Social Security numbers.
On Wednesday, a Reddit user alerted Starlink customers about the phishing scam, which arrives as an email from "Starlink Team 2024." The fake email tells unsuspecting users that their "registered payment method has been deleted due to incorrect data we had on file" and requests that they re-enter their information "in order to avoid late payment fees."
(Credit: Reddit user I_dont_know_you_pick)The malicious email then directs users to click a link to log into their Starlink accounts. But in reality, the link will send the victims to a look-alike but malicious Starlink login portal.
To dupe users, the malicious Starlink login site contains links that’ll forward you to official Starlink pages from SpaceX. But the portal’s main component, the email and password login, will send you to another hacker-controlled page—this one designed to collect your most sensitive personal information under the guise of verifying your payment information.
(Credit: Malicious Starlink page)The final stage of the attack asks the user to provide details to their payment card as well as date of birth, Social Security number, mother's maiden name, and driver's license number. "This is a mandatory security measure due to a change in our system,” the phishing attack claims.
(Credit: Malicious Starlink page)If a victim falls for the trick, the malicious site will accept all the information and then display a new page, saying: “Your payment information is now VERIFIED. No charge until your next billing date. Thank you for updated information. In a few moments, you will be redirected to starlink.com.” Hence, victims may come away thinking they went through a normal Starlink payment process without realizing they gave up their most sensitive personal information to an elaborate hacking scheme. In the wrong hands, the details can be exploited to make fraudulent credit card charges and conduct other identity theft schemes against the victim.
The good news is that the scam can be easy to detect if you look at the sender of the fake Starlink email and at the URL of the malicious login page: None will be attached to an official Starlink domain. In fact, this particularly fake Starlink email came from "edparent@xplornet.com,” according to the Reddit user. Meanwhile, the phishing page itself was hosted on a .es domain from Spain.
The malicious Starlink pages will also accept any information you type, including a made-up password—a telltale sign that the phishing attack is designed solely to collect your information.
But one lingering mystery is whether the scammers have found a way to identify Starlink subscribers. The Reddit user who received the phishing attack told PCMag: "No idea how they would know I'm a Starlink customer, it may just be a mass email scam with the idea that a certain percentage of the recipients are Starlink customers. The email it was sent from was an xplornet address, with whom I was a customer before switching to Starlink."