New Phishing Attack Delivers Three Types Of Malware To Victims and Use HTML Email Attachments
New Phishing Attacks Use HTML Email Attachments
Posted by upstatetechsupport On?June 14, 2022
HTML attachments as an attack vector may seem a little old school. However, according to statistics compiled by Kaspersky Lab indicates that in 2022, that form of attack is not just simply still being employed, but hackers are making surprisingly regular use of it.?The security company detected more than two million emails of this kind targeting Kaspersky customers in the first four months of the year (2022).
The specific breakdown of monthly instances looks like this:
The researchers aren't clear on exactly what caused the huge spike in March but they note that it returned to expected levels the month following.
Using HTML attachments as an attack vector saw a big spike in 2019 and then it seemed to fall out of favor. The number of instances dropped markedly and prompted some security researchers to conclude that, based on current trajectories, the attack vector was on the way out.
The last four months seem to have disproved that notion and HTML attachments are back in fashion in the underbelly of the web.
It's important to remember that merely opening these files is in many cases enough to have JavaScript run on your system. That could lead to the target system being hijacked using a malware-assembly-on-disk scheme that could allow it to bypass antivirus software entirely.
This isn't something that gets mentioned very often in employee email safety training, but it should be.
As ever, the best defense against any type of phishing attack is to treat any incoming email message from a sender you don't know with a healthy dose of skepticism. If that email contains an attachment, those attachments should be treated even more skeptically.
领英推荐
New Phishing Attack Delivers Three Types Of Malware To Victims
Phishing campaigns get more effective the more closely they can imitate a trusted source.?Recently, security researchers at Fortinet discovered evidence of a phishing campaign that specifically targets Microsoft Windows users and installs three different types of malware on the systems it manages to infect.
Among other things, this campaign gives the hackers behind it the ability to steal usernames, passwords, banking details, and more. That is in addition to leveraging the infected system to secretly mine for cryptocurrency, which finds its way into a wallet controlled by the hackers.
To lure victims into infecting themselves, the Phishing campaign's contact emails are all designed to appear as a payment report from a legitimate trusted source, which contains an attached Microsoft Excel document. It is conveniently included for the recipient's review. Naturally, anyone opening the attached document dooms themselves, as it is poisoned and contains scripts designed to install malicious payloads in the background.
Phishing campaigns remain one of the most popular infection methods in the hacking world.?They tend to gravitate to those techniques that work and require relatively little in the way of effort.
Phishing fits that bill perfectly.?It's usually a trivial matter to create an email that's virtually identical to one you might get from a trusted source, and hackers have been poisoning Microsoft Excel files since the earliest days of the internet.
As ever, the best defense against these types of attacks is vigilance and mindfulness.?A quick phone call to the trusted source that supposedly sent you the email communication is almost always enough to verify whether it is real. Shockingly, few users take this step.
In a similar vein, clicking on embedded links in an email or downloading files should be done with a healthy dose of caution. That includes another phone call to the trusted source to be sure they did in fact send you something.
Unfortunately, that's a lot easier to teach than it is to implement, as employees don't have a good track record with either of those things.
If you are concerned about your companies' security we can help! We have a few openings left for our free security assessment in June. If you are interested KNOWING if you are secure visit: https://www.upstatetechsupport.com/cyber-security-assessment/ and sign up today.