Cofense Phishing Prevention & Email Security Blog

Reporting Matters – even for a Smishing Message

HTA Files Distributed as Fake Chrome Patches for CVE-2021-30554

Cofense Protect MSP: First Cloud-Native Email Security for Office 365 & Google Workspace

Thinking of Smishing Your Employees? Think Twice.

Hat Trick: Office Macros, VBS and CVEs highlight TrickBot’s June Debut

Nested Archives Help to Evade SEGs and Deliver BazarBackdoor

The Difference Between an Attempted Attack and a Widespread Ransomware Attack is Employee Reporting

By Tonia Dudley, Strategic Advisor The recent Kaseya attack, in which threat actors leveraged a zero-day vulnerability over the holiday weekend, demonstrates that ransomware is here to stay. Further, the reported $70 million ransom demand to end the attack shows us how lucrative ransomware remains for threat actors around the globe. According to the company’s incident update, their R&D team was actively working on a patch for this reported vulnerability. We now know it had already been compromised, but they quickly initiated their incident response process quickly and made information available at a regular cadence to their customers and the public. What...

Extracting Pesky Chanitor DLLs

Simplistic Phish Bypasses Secure Email Gateway

The Ryuk Threat: Why BazarBackdoor Matters Most

GuLoader Rises as a Top Malware Delivery Mechanism in Phishing

“You’re Invited!” to Phishing Links Inside .ics Calendar Attachments

Practice Makes Perfect

New Mass Logger Malware Could Be Massive

Zoom Phish Zooming Through Inboxes Amid Pandemic

Phishers Cast a Wider Net in the African Banking Sector

MFA Bypass Phish Caught: OAuth2 Grants Access to User Data Without a Password

A Not So Relieving Tax Relief Email: Threat Actors Take Aim at US Stimulus Efforts

Reporting Matters – even for a Smishing Message

HTA Files Distributed as Fake Chrome Patches for CVE-2021-30554

Cofense Protect MSP: First Cloud-Native Email Security for Office 365 & Google Workspace

Thinking of Smishing Your Employees? Think Twice.

Hat Trick: Office Macros, VBS and CVEs highlight TrickBot’s June Debut

Nested Archives Help to Evade SEGs and Deliver BazarBackdoor

The Difference Between an Attempted Attack and a Widespread Ransomware Attack is Employee Reporting

By Tonia Dudley, Strategic Advisor The recent Kaseya attack, in which threat actors leveraged a zero-day vulnerability over the holiday weekend, demonstrates that ransomware is here to stay. Further, the reported $70 million ransom demand to end the attack shows us how lucrative ransomware remains for threat actors around the globe. According to the company’s incident update, their R&D team was actively working on a patch for this reported vulnerability. We now know it had already been compromised, but they quickly initiated their incident response process quickly and made information available at a regular cadence to their customers and the public. What...

Extracting Pesky Chanitor DLLs

Simplistic Phish Bypasses Secure Email Gateway

“You’re Invited!” to Phishing Links Inside .ics Calendar Attachments

Practice Makes Perfect

Zoom Phish Zooming Through Inboxes Amid Pandemic

Phishers Cast a Wider Net in the African Banking Sector

MFA Bypass Phish Caught: OAuth2 Grants Access to User Data Without a Password

A Not So Relieving Tax Relief Email: Threat Actors Take Aim at US Stimulus Efforts

Phishers Continue to Spoof WebEx

Want to simulate a holiday phish? This one’s from your friends at Emotet.

By Tonia Dudley Tis the season when organizations are looking to send out the year’s last phishing simulation. Often the Security Awareness team lands on a holiday theme – holiday party, holiday raffle, or even the fun ugly sweater lure. In the past, when I worked with teams to advance their phishing defense programs, I would recommend staying away from holiday themed scenarios. I’ll explain why in a moment. But my opinion has changed, thanks to the threat actors behind Emotet.

Trickbot Is Using Google Docs to Trick Proofpoint’s Gateway