Posts

Watch out: These phishing emails claiming to be a ‘secure message’ from your bank

Cyber criminals are faking secure messages from banks as a means of delivering malware to victims.

Often provided through an online portal, banks often provide secure messaging services for the purposes of communicating with the bank without having to pick up the phone or visit the a branch.

Hackers have realised that this provides a new method of attack and are now crafting spoof emails claiming to contain documentation relating to secure messages.

The sorts of clients who opt to use these secure messaging services are often high-value targets who already have a trusting online relationship with their bank – so could be more willing to follow instructions they get in an email from scammers that they believe to be real.

Criminals are registering domains that appear to look like legitimate bank domains and the fact they’re fake goes unnoticed because users don’t know how to spot an imposter or their email client doesn’t show the full domain in the subject line.

Uncovered by security researchers at Barracuda Networks, the campaign uses phishing emails to impersonate customers of big banks including Bank of America and TD Commercial banking.

The spoof messages are designed in such a way so as to look legitimate, even featuring sender addresses which look as if they come from the institution.

In some instances, the messages simply ask the victim to click on and download and attached document. However, others keep up the façade of being ‘secure’ – some emails provide instructions about using an authorization code to ‘unlock’ the attachment.

The malicious payload within is able to rewrite the files in the users’ directory on Windows machines once the victim opens the document – and this script can potentially missed by anti-virus software, thrown off the scent because they think the document is benign.

However, once downloaded onto the system, criminals have access to it and can update the script at a later date to become something more malicious, such as credential stealing malware – enabling them to stealthily gain access to the bank account of the victim – or something more brazen like ransomware.

Faking email messages might seem like a basic attack, but criminals are deploying this tactic because it works – especially when trusted institutions such as banks are used.

However, the good news is that users can be trained to spot phishing attacks – taking a step back and assessing the legitimacy of an email can go a long way towards protecting an individual or their organisation from falling victim to hackers.

zdnet

Office 365: A Vehicle for Internal Phishing Attacks

A new threat uses internal accounts to spread phishing attacks, making fraudulent emails even harder to detect.

Cybercriminals go where the users are. Office 365, which has more than 100 million active monthly subscribers, has become a hotspot for compelling and personalized cyberattacks. Users trust emails from coworkers, especially those with the correct corporate email address.

Traditional phishing attempts have red flags: suspicious attachments, bold requests, misspelled words, questionable email addresses. Users know how to react to these. But what happens when attacks are more personalized, with legitimate addresses and reasonable requests?

These have become more popular and tougher to spot, says Asaf Cidon, spearphishing expert at Barracuda. The company recently released a report on a threat he calls Account Compromise. Once they have an employee’s Office 365 account information, threat actors can craft realistic-looking messages and send them from an account their victims trust.

Attackers primarily steal credentials using traditional methods, he continues. Most rely on phishing or spearphishing to send victims to fraudulent websites, where they are prompted to reset their Office 365 credentials. Some buy users’ credentials on the dark web.

“What’s new is what happens after they get access to the accounts,” Cidon says. Threat actors can conduct several types of attacks after they gain a foothold in an organization.

In one common scenario, an attacker sets forwarding rules on an Office 365 account to send emails to an account they control. From there, they can both steal data and monitor the user’s internal and external communication patterns so they can plan future attacks.

Threat actors also impersonate their victims and send emails to other employees with the goal of collecting data. Some send emails with PDF attachments that can only be opened with a username and password. Some send an invoice for payment that requires logging into a web portal, where they have to log in with a corporate email address and password.

Damage could potentially extend outside the organization. Cidon explains a scenario in which an attacker, impersonating an employee, used their access to request a wire transfer from a partner company. The employee in the scenario didn’t even realize the transfer was happening.

“This is an evolution of spearphishing – we’re seeing more and more sophistication,” he says. A couple of years ago, cyberattackers primarily targeted executive employees. These new Office 365 threats are putting all employees at risk.

“With this attack, they’re just trying to get in and once they’re in, a lot of the employees getting targeted are not high-level. It’s not just executive targets,” Cidon continues.

There are red flags that signify a company is targeted in one of these attacks. Oftentimes the IP addresses used to log into corporate accounts come from other countries, he says, and looking at the log can identify geographical anomalies. It also helps to keep track of your email account to see when emails are getting forwarded or sent to unfamiliar addresses.

Cidon advises security leaders to train employees on how to spot phishing attacks to prevent attackers gaining initial access. He also advises adding security layers like multi-factor authentication to Office 365 to lessen the chance of a break-in.

“Traditional email security systems are going to be almost useless in stopping this,” he says, noting how most tools look at the API of the email provider. “Once an attacker is in, they don’t see internal emails … only the external emails coming in.”

DARKReading

This Phishing Attack is Almost Impossible to Detect On Chrome, Firefox and Opera

A Chinese infosec researcher has discovered a new “almost impossible to detect” phishing attack that can be used to trick even the most careful users on the Internet.

He warned, Hackers can use a known vulnerability in the Chrome, Firefox and Opera web browsers to display their fake domain names as the websites of legitimate services, like Apple, Google, or Amazon to steal login or financial credentials and other sensitive information from users.

Read more