Naver has issued a warning after discovering phishing emails impersonating South Korean government agencies \u2014 including the Blue House, the National Tax Service, the Korean National Police Agency, and WETAX \u2014 in an attempt to steal users’ account credentials. Attackers are luring victims into clicking links using urgent-sounding subjects such as tax notices, police summons, and livelihood recovery subsidy announcements.<\/p>\n
According to a notice posted on Naver’s customer center on the 24th, emails impersonating the Blue House used the subject line “Notice for Livelihood Recovery Subsidy Recipients” to entice users into registering a bank account for receiving funds. Emails posing as the National Tax Service and WETAX were disguised as “Mandatory Registration Notice for Electronic Notification Service” and “A Tax Bill Has Arrived in Your Local Tax Electronic Mailbox,” respectively.<\/p>\n
Emails impersonating the Korean National Police Agency were also identified. Titled “Request to Appear Regarding a Case Involving Violation of the Information and Communications Network Act,” the messages claimed that a case had been filed for cyber defamation and insult, demanding the recipient appear before police. These emails included the police agency’s logo, a case number, legal provisions, and an appearance deadline, making them look like authentic documents from an investigative authority.<\/p>\n
When users click buttons such as “View Notice Details,” “View Case Materials,” or “Register Receiving Account,” they are redirected to fake websites designed to closely resemble Naver’s login page. These phishing pages not only display the Naver logo but also pre-fill the user’s email address, making it easy to mistake them for legitimate login pages.<\/p>\n
However, the address bar shows a domain other than “nid.naver.com,” Naver’s official login URL. If a user enters their password on this screen, their account credentials can be transmitted directly to the attackers.<\/p>\n
Some phishing emails include the actual main phone numbers of the impersonated government agencies or legitimate-looking security notices. Even if the phone numbers or agency information match what appears in internet searches, users should not assume an email is genuine \u2014 attackers may have simply copied publicly available information.<\/p>\n
WETAX and Hometax do, in fact, send notification emails. Therefore, receiving a tax- or subsidy-related email alone does not automatically mean it is a phishing attempt. The key distinguishing factor is that legitimate government business never requests a Naver password or verification code through links embedded in emails.<\/p>\n
Naver explained that government systems were not breached; rather, attackers misappropriated agency names and publicly available document formats to craft the phishing emails. “These cases involve phishing emails created by attackers who misappropriated agency names and publicly available document formats,” the company stated. “Even if the email content appears urgent, do not click links first \u2014 verify through official apps or websites.”<\/p>\n
Recommended actions for users are as follows: Instead of clicking links in emails, access the relevant agency’s official app or website directly to verify the information. When contacting an agency, use the main phone number listed on the official website rather than any contact information provided in the email.<\/p>\n
If a user has already entered their password on a fake site, they should change it immediately. Passwords for other services using the same credentials should also be changed, and two-factor authentication should be enabled on the Naver account. If phishing damage is suspected, users can report it to the Korea Internet & Security Agency (KISA) by calling the 118 helpline.<\/p>\n
Naver stressed that any request to enter a password under the pretext of verifying taxes, fines, or subsidies should be treated as phishing. “There is no reason to re-enter your Naver password to check taxes or subsidy information,” the company explained.<\/p>\n","protected":false},"excerpt":{"rendered":"Naver has issued a warning after discovering phishing emails impersonating South Korean government agencies \u2014 including the Blue…\n","protected":false},"author":2,"featured_media":142098,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[623],"tags":[5594,72299,1416,12040,657,72300,72297,72298],"class_list":["post-142097","post","type-post","status-publish","format-standard","has-post-thumbnail","category-naver","tag-blue-house","tag-korea-internet-u0026amp-security-agency","tag-korean-national-police-agency","tag-national-tax-service","tag-naver","tag-nid-naver-com","tag-phishing-email","tag-wetax"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts\/142097","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/comments?post=142097"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/posts\/142097\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/media\/142098"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/media?parent=142097"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/categories?post=142097"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/korea\/wp-json\/wp\/v2\/tags?post=142097"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}