A Very Convincing Tax-Rebate Phishing Campaign Is Targeting UK Users
July 19, 2018 by Milo Salvia in Phishing Defense CenterThe Cofense™ Phishing Defence Center has observed a convincing new phishing campaign targeting taxpaying UK nationals. The threat actors posing as Her Majesty’s Revenue and Customs (HMRC) have imitated the Government Gateway tool which is commonly used by UK citizens to access government services online. The threat actor attempts to convince victims that they are due a tax rebate of £458.21 using the lure below.
This “Man in the Inbox” Phishing Attack Highlights a Concerning Gap in Perimeter Technology Defenses
July 18, 2018 by Nick Guarino in Phishing Defense Center“Man in the Inbox” phishing attacks come from compromised email accounts. They look like someone from within a business, for example the HR director, sent an email directing employees to do something legitimate—like logging onto a fabricated page to read and agree to a corporate policy. When employees log on, the attackers harvest their credentials. These attacks are yet another example of increasingly sophisticated credential phishing.
New TrickBot Phishing Lure: Mistake or Experiment?
July 17, 2018 by Cofense in Threat IntelligenceCofense Intelligence™ recently identified a TrickBot campaign that was noteworthy not for its exceptional guile or novel technique, but rather for its lack thereof. Absent any images or convincing textual narrative, the campaign lacks all the hallmarks of this TrickBot distribution group’s modus operandi.
Data to Dollars: “Value at Risk” Anti-Phishing Strategies
July 16, 2018 by Zach Lewis in Internet Security AwarenessPart 2 of 3 Last week, we looked at the concept of “value at risk” (VAR) and how it applies to anti-phishing. This week let’s do a deep-dive into the “value” aspect of VAR. We’ll ask: do you know where your crown-jewel data is stored and how much it might be worth? Even if the answer is “Not exactly,” an educated guess can help set anti-phishing priorities.
This Amazon Prime Day, Keep Your Network Safe from Phishing
July 12, 2018 by Josh Bartolomie in Internet Security AwarenessUnfortunately, with the world we live in, especially with any type of highly visible promotions or sales, scammers will try to take advantage of the situation. Remember last year’s Amazon Prime Day phishing scam? Consumers around the world received an email promising a $50 bonus for writing a product review, or an email stating there was a problem with their payment method or shipping information. When they clicked on an embedded link, they went to a bogus login page designed to harvest their credentials.
Turning a blind eye: How end-users and NLP AI are being tricked by clever phishing techniques like ZeroFont
July 11, 2018 by Jason Meurer in Malware AnalysisOverview Recently, an older email security detection bypass method was seen being used to successfully surpass Microsoft’s spam and phishing filters. This technique described above makes use of two methods and was dubbed “ZeroFont Phishing” by Avanan. ZeroFont Phishing is the method when attackers insert random strings within keywords or phrases that many artificially intelligent systems use to identify malicious or suspicious content. When these strings are placed within the HTML span tags mixed with setting the font-size attribute to zero, they become invisible to the end user, but simultaneously appear to neuter the ability of existing Natural Language Processing...
“Value at Risk”: Focus Your Anti-Phishing on the Bottom Line
July 10, 2018 by Cofense in Internet Security AwarenessPart 1 of 3: Over the past year at Cofense, we’ve introduced and discussed the importance of elevating the visibility of anti-phishing programs to the Board of Directors level. The key measures we presented included a measure of capability we refer to as ‘resilience’ and enumeration of which specific attacks your organization may be facing. As a result, the questions we are now answering for board members globally are – “What phishing threats do you need to be the most concerned with?” “How likely are you to stop those specific attacks in progress?” In the same time frame, the World...
AZORult Malware Finds a New Ride with Recent Stealer Phishing Campaign
July 9, 2018 by Aaron Riley in Threat IntelligenceCofense Intelligence™ has uncovered a recent AZORult stealer phishing campaign that delivers the malware via malicious attachments. Older versions of AZORult stealer have been delivered via intermediary loaders, typically Seamless or Rammnit malware. In this latest campaign, the attached documents use multiple techniques to download and execute an AZORult sample, indicating a shift by the threat actors behind the campaign to adopt more evasive delivery techniques.
Geodo Malware Targets Patriots with Phishing Attack on Eve of American Independence Day Holiday
July 3, 2018 by Cofense in Threat IntelligenceBy Brendan Griffin and Max Gannon A classic phishing technique involves timing attacks to match major holidays and other global and regional events. One example of this scenario in a phishing attack captured by Cofense Intelligence™ delivering the Geodo botnet malware on July 3, 2018. In this attack the threat actor appeals to the patriotic nature of the Fourth of July holiday and recipients’ sense of patriotism in its content. In these messages, the attacker reminds the recipient of the sacrifices of American service member as part of a narrative designed to entice victims to click on the link in...