How fraudsters exploit Coop and Atlassian in phishing attacks

The fraudsters start by verifying your account – a skilful phishing attack. Here’s how you’re tricked – and how to protect yourself.

About a week ago, I unexpectedly received a genuine email from the supermarket chain Coop, of which I am a member. Apparently, I had requested to reset my password, but as this didn’t add up, I became suspicious. Without clicking on anything in the email, I went to Coop’s website, logged in and changed my password myself. After that, I didn’t give it another thought.

A week later – the phishing attempt

Today I received an email that appeared to come from Coop. The subject line was: “Your points have been converted into cash!”. It could, of course, have been about some news regarding their points system, but something felt wrong. And it was: it was a fairly well-thought-out phishing attempt, hidden behind two trusted systems – Atlassian and Coop.

This attack is interesting because the scammers first verify your account – before they’ve even sent an email.

Here’s how it happened.

How the scammers trick you – step by step

Step one: They check whether your account exists

The scammers exploit Coop’s password reset feature to find out if your email address is active. If the system sends a reset link, they know that you’re a target worth attacking. What happens if I enter an address that doesn’t have an account? In that case, Coop displays the following message on the page: “There is no user account on coop.se with this email address.” 👀

Coop inadvertently reveals whether an account exists – and the scammers rejoice. 🙌

Step two: They create a fake, but credible, environment

The fraudsters set up a fake instance on Atlassian Jira Service Management, for example:

• coop-sverije.atlassian.net (note the spelling mistake).

The fraudsters then send the email via Atlassian’s and Amazon’s infrastructure – and the email therefore appears to come from a legitimate source.

Step three: The email with the fake link

The email contains:

• Sender: Coop Member <medlem@coop-sverije.atlassian.net>
• Link: To a fake login page on DigitalOcean Spaces.
• Suspicious detail: German greetings such as “Guten Tag” – either a mistake or a way to filter out inattentive recipients.

How to protect yourself – and your organisation

For you as a user

• Never click on links in unexpected emails – hover your mouse pointer over links to see where they lead.
• Check the sender’s domain – Official Coop emails always come from @coop.se or @coopmedlem.se.
• Use a password manager – it can often warn you about fake websites.
• Enable MFA (multi-factor authentication) on all important accounts.

For businesses (IT departments and, not least, Coop and Atlassian)

• Stop revealing whether accounts exist – use generic messages such as: “If there is an account linked to this email address, we have sent a reset link.”
• Block domains that imitate well-known brands (e.g. “coop-sverige”).
• Monitor and take down phishing sites on DigitalOcean Spaces.

We must be vigilant against fraudsters

This is a clear example of how fraudsters exploit our own systems against us. By understanding their methods and taking the right action, you can protect yourself – and help others do the same.

And those of us who work on the technical development and management of these systems: we must always be on our guard and continue to work against the fraudsters. Not give them a helping hand.

What does the email say?

I’ll paste the actual text of the email here, in case anyone is searching for phrases from the mailing:

Your membership bonus is loaded and ready!

First, In Swedish (and a bit of German):

Ditt medlemsbonus är laddat och klart!
Guten Tag,
Kort och gott: din nya medlemsbonus finns nu tillgänglig på ditt konto. Du kan dra av den direkt vid nästa köp.
Klicka nedan för att komma åt ditt bonussaldo:
Använd din bonus nu
Tack för att du gör dina vardagsinköp hos oss.
Med vänliga hälsningar,
Coop Medlem

Secondly, in English:

Guten Tag,
In short: your new membership bonus is now available in your account. You can deduct it straight away on your next purchase.
Click below to access your bonus balance:
Use your bonus now
Thank you for doing your everyday shopping with us.
Kind regards,
Coop Member