# data[].attributes.attachment_link.title
Cybercriminals target metaverse investors with phishing scams

# data[].attributes.attachment_link.description
Fraudsters are targeting the metaverse with phishing scams to steal land from investors.

# data[].attributes.attachment_link.readable_text
Microsoft has warned Office 365 customers that they're being targeted by a widespread phishing campaign aimed at nabbing usernames and passwords.

The ongoing phishing campaign is using multiple links; clicking on them results in a series of redirections that lead victims to a Google reCAPTCHA page that leads to a bogus login page where Office 365 credentials are stolen.

ZDNet Recommends

The best cyber insurance

The cyber insurance industry is likely to go mainstream and is a simple cost of doing business. Here are a few options to consider.

This particular attack relies on the email sales and marketing tool called ' open redirects', which has been abused in the past to redirect a visitor to a trustworthy destination to a malicious site. Google doesn't rate open redirects for Google URLs as a security vulnerability, but it does display a 'redirect notice' in the browser.

SEE: Ransomware: This new free tool lets you test if your cybersecurity is strong enough to stop an attack

Microsoft warns this feature is being used by the phishing attackers.

"However, attackers could abuse open redirects to link to a URL in a trusted domain and embed the eventual final malicious URL as a parameter. Such abuse may prevent users and security solutions from quickly recognizing possible malicious intent," the Microsoft 365 Defender Threat Intelligence Team warns.

This attack's trick relies on the advice for users to hover over a link in an email to check the destination before clicking.

"Once recipients hover their cursor over the link or button in the email, they are shown the full URL. However, since the actors set up open redirect links using a legitimate service, users see a legitimate domain name that is likely associated with a company they know and trust. We believe that attackers abuse this open and reputable platform to attempt evading detection while redirecting potential victims to phishing sites," Microsoft warns.

"Users trained to hover on links and inspect for malicious artifacts in emails may still see a domain they trust and thus click it," it said.

Microsoft has found over 350 unique phishing domains used in this campaign, including free email domains, compromised domains, and domains automatically created by the attacker's domain generation algorithm. The email subject headers were tailored to the tool the attacker was impersonating, such as a calendar alert for a Zoom meeting, an Office 365 spam notification, or a notice about the widely used but ill-advised password expiry policy.

While open redirects aren't new, Microsoft hopped on the issue after noticing a phishing campaign in August that relied on spoofed Microsoft URLs.

The Google reCaptcha verification adds to the apparent legitimacy of the site since it is generally used by websites to confirm the user is not a bot. However, in this case, the user has been redirected to a page that looks like a class Microsoft login page and eventually leads to a legitimate page from Sophos, which does provide a service to detect this style of phishing attack.

SEE: The Privacy Paradox: How can businesses use personal data while also protecting user privacy?

"If the user enters their password, the page refreshes and displays an error message stating that the page timed out or the password was incorrect and that they must enter their password again. This is likely done to get the user to enter their password twice, allowing attackers to ensure they obtain the correct password.

"Once the user enters their password a second time, the page directs to a legitimate Sophos website that claims the email message has been released. This adds another layer of false legitimacy to the phishing campaign."

Google's word on the matter of open redirects is that this is not a security vulnerability, though it admits it can be used to trigger other vulnerabilities. However, Google disputes the idea that hovering over a link in an app to see a destination URL is a useful phishing awareness tip.

"Open redirectors take you from a Google URL to another website chosen by whoever constructed the link. Some members of the security community argue that the redirectors aid phishing, because users may be inclined to trust the mouse hover tooltip on a link and then fail to examine the address bar once the navigation takes place.

"Our take on this is that tooltips are not a reliable security indicator, and can be tampered with in many ways; so, we invest in technologies to detect and alert users about phishing and abuse, but we generally hold that a small number of properly monitored redirectors offers fairly clear benefits and poses very little practical risk."

# data[].attributes.attachment_link.title
This phishing attack is using a sneaky trick to steal your passwords, warns Microsoft | ZDNet

# data[].attributes.attachment_link.description
Microsoft has warned Office 365 customers that they're being targeted by a widespread phishing campaign aimed at nabbing usernames and passwords. The ongoing phishing campaign is using multiple links; clicking on them results in a series of redirections that lead victims to a Google reCAPTCHA page that leads to a bogus login page where Office 365 credentials are stolen.

# data[].attributes.attachment_link.readable_text
A phishing campaign targeting Microsoft Windows users delivers three different forms of malware, all designed to steal sensitive information from victims.

Detailed by cybersecurity researchers at Fortinet, those who unintentionally run the malicious attachment sent in phishing emails fall victim to AveMariaRAT, BitRAT and PandoraHVNC trojan malware.

The campaign allows cyber criminals to steal usernames, passwords and other sensitive information, including bank details. BitRAT is particularly dangerous to victims, because it can take full control of infected Windows systems, complete with the ability to view webcam activity, listen to audio through the microphone, secretly mine for cryptocurrency that goes into a wallet owned by the attackers and download additional malicious files.

The initial phishing message is designed to look like a payment report from a trusted source, with a short request to open an attached Microsoft Excel document.
SEE: Cybersecurity: Let's get tactical
This file contains malicious macros and researchers note that, when the document is opened, Microsoft Excel flags potential security concerns about the use of macros. If the user ignores this message and opens the file, it starts the process of delivering malware.

Using Visual Basic Application (VBA) scripts and PowerShell, the malware is retrieved for installation onto the victim's machine. The PowerShell code is split into three parts for the three different forms of malware, which can each be installed.

The research does not detail why the phishing email delivers three malware payloads, but it's likely that with three different forms of malware to deploy, there's a greater chance of the cyber criminals being able to gain access to whatever sensitive information they're looking to steal.

Phishing remains one of the most common methods cyber criminals use to deliver malware because, put simply, it's effective - but there are things that can be done to avoid falling victim.

Users should be wary of unexpected emails claiming to contain important information hidden in attachments - particularly if that attachment requires you to enable macros first. If possible, for example, if the email claims to come from a college or business associate, you could contact them using a different method than email to check if it's really them who sent the email.

Businesses can also help employees avoid falling victim to phishing emails by using appropriate anti-spam and anti-virus software, as well a training users on how to spot and report phishing emails.

MORE ON CYBERSECURITY

# data[].attributes.attachment_link.title
This phishing attack delivers three forms of malware. And they all want to steal your data

# data[].attributes.attachment_link.description
A phishing campaign targeting Microsoft Windows users delivers three different forms of malware, all designed to steal sensitive information from victims. Detailed by cybersecurity researchers at Fortinet, those who unintentionally run the malicious attachment sent in phishing emails fall victim to AveMariaRAT, BitRAT and PandoraHVNC trojan malware.

# data[].attributes.attachment_link.readable_text
Cybersecurity firm Armorblox discovered a new phishing campaign aimed at American Express customers.

Armorblox researchers uncovered a new phishing campaign that is targeting American Express customers.

The messages use a malicious attachment and their content attempt to trick cardholders into opening it.

The subject of the emails reads "Important Notification About Your Account" in an attempt to urge recipients to open it. Once opened, the email appears as a legitimate email communication from American Express, while the content instructs the cardholder on how to view the secure, encrypted message attached.

"Upon opening the attachment, victims were greeted with a message announcing additional verification requirements for the associated account. Urgency was instilled within the victims through the inclusion of the language, "This is your last chance to confirm it before we suspend it", and a prompt for victims to complete a one-time verification process that was needed as part of a global update from the American Express team." reads the analysis published by the Armorblox.
Upon clicking on the link in the message, victims are redirected to a fake American Express login page, which includes the company's logo and a link to download the American Express app.

The page was crafted to request the victims to enter their user ID and password.

The phishing campaign bypassed native Google Workspace email security controls because it passed both DKIM and SPF email authentication.

Threat actors behind the campaign used a valid domain to send this malicious email, the domain used by the sender received a reputation score of trustworthy and global threat history of zero security events. The phishing email, marked by Google as safe, was delivered to more than 16,000 users' addresses.

Below are the recommendations provided by Armorblox to identify phishing messages:

Augment native email security with additional controls;

Watch out for social engineering cues;

Follow multi-factor authentication and password management best practices;

Follow me on Twitter: @securityaffairs and Facebook

# data[].attributes.attachment_link.title
A new phishing scam targets American Express cardholders

# data[].attributes.attachment_link.description
Armorblox researchers uncovered a new phishing campaign that is targeting American Express customers. The messages use a malicious attachment and their content attempt to trick cardholders into opening it. The subject of the emails reads "Important Notification About Your Account" in an attempt to urge recipients to open it.

# data[].attributes.attachment_link.readable_text
Many Internet users currently seem to have an e-mail from Bawag PSK in their inbox. It claims that your bank account has been banned because you have not installed the security app. You are requested to click on a link and do so. Do not follow this instruction under any circumstances, you will be taken to a fake login page.

As explained in the phishing email above, your access to the bank account has been restricted, so you should now follow the link in the "Start Processing" message. Do not trust such links. Instead, access your online banking as usual. You will find that everything works as usual.
Note the web address in the picture. This is not a real BAWAG website!
If you do not notice the fraudulent website and do not leave the website, they claim that you will have to scan a QR code to download the app as a first step. Then you should accept the installation from unknown sources in the settings of your smartphone.

Note: At this point in the latest it should be clear that this is a scam. Your bank will never ask you to install apps from unknown sources. Doing so will load malware onto your device and allow criminals to get your money and/or data.

What protects against phishing?

You should always be skeptical about emails about sensitive topics like your online banking, your social media accounts and the like. Note the sender's address, address, spelling mistakes or errors in the address, and use an alternative method to check whether the information in the messages is actually true.

This is the best way to protect yourself from phishing attempts!

Have you entered the data and installed the app?

If you've only opened the email, there's no reason to worry. However, if you have entered personal data on a fraudulent website or installed a suspicious app, action is urgently needed. Contact your bank immediately and discuss how to proceed. It is likely that your account will be blocked, or at least your login data will need to be updated. You have to remove the malware from your smartphone again. This usually requires a factory reset. Note that all data will be lost in this process.

If you have already suffered damages and criminals stole money from you, we recommend that you report the matter to the police.

Bavag himself writes on this subject:

Third parties use "phishing" to try to get into someone's account and login data. The sender of a phishing email pretends to be someone else and uses various excuses to disclose confidential data to the recipient. These can excuse, for example, "Your account has been locked" or "Security software/app needs to be installed". The goal is to reveal your personal information to the recipient.

You can stop phishing with these simple steps:

To avoid fraud attempts from the outset, you should only use your e-banking on trusted end devices and networks - but not on public devices, for example.

Always pay attention to the sender of e-mails, especially if they don't seem secure to you. Fake emails often have hidden spelling mistakes or false logos.

For a generally high level of protection against phishing, it is still advisable for each user to establish separate access to the end device, which is protected by a strong password.

Also make sure that your computer or smartphone always has the latest (security) updates for your operating system and browser. It is always advised to activate automatic updates to ensure that the system and applications are up to date.

It is also important to have security features on smartphones and computers, as disabling such features can lead to security vulnerabilities, which can increase the risk of data misuse, such as through phishing emails or fraudulent websites.

Source: Bawag, Watchlist Internet
Information: This material reflects the current status at the time of publication
was. Used for playback of individual images, screenshots, embeddings or video sequences
Discuss the topic with the subject.

# data[].attributes.attachment_link.title
WARNING ABOUT CURRENT BAWAG Phishing Mail!

# data[].attributes.attachment_link.description
Many Internet users currently seem to have an e-mail from Bawag PSK in their inbox. It claims that your bank account has been banned because you have not installed the security app. You are requested to click on a link and do so.

# data[].attributes.attachment_link.readable_text
The Lampion malware is being distributed in greater volumes lately, with threat actors abusing WeTransfer as part of their phishing campaigns.

WeTransfer is a legitimate file-sharing service that can be used free of charge, so it's a no-cost way to bypass security software that may not raise alerts about the URLs used in emails.

In a new campaign observed by email security firm Cofense, Lampion operators are sending phishing emails from compromised company accounts urging users to download a "Proof of Payment" document from WeTransfer.

Spam mail with link to a WeTransfer download (Cofense)

The file the targets receive is a ZIP archive containing a VBS (Virtual Basic script) file the victim needs to launch for the attack to begin.

Contents of the malicious ZIP file (Cofense)

Upon execution, the script initiates a WScript process that creates four VBS files with random naming. The first one is empty, the second has minimal functionality, and the third's only purpose is to launch the fourth script.

Cofense analysts comment that this extra step is unclear, but modular execution approaches are typically preferred for their versatility, allowing easy file swaps.

The fourth script launches a new WScript process that connects to two hardcoded URLs to fetch two DLL files hiding inside password-protected ZIPs. The URLs point to Amazon AWS instances.

URLs hosting the DLL payloads (Cofense)

The password for the ZIP files is hardcoded in the script, so the archives are extracted without requiring user interaction. The contained DLL payloads are loaded into memory, allowing Lampion to be stealthily executed on compromised systems.

From there, Lampion begins stealing data from the computer, targeting bank accounts by fetching injections from the C2 and overlaying its own login forms on login pages. When users enter their credentials, these fake login forms will be stolen and sent to the attacker.

Lampion revitalized

The Lampion trojan has been around since at least 2019, focusing mainly on Spanish-speaking targets and using compromised servers to host its malicious ZIPs.

In 2021, Lampion was seen abusing cloud services for hosting the malware for the first time, including Google Drive and pCloud.

More recently, in March 2022, Cyware reported an uptick in the trojan's distribution, identifying a hostname link to Bazaar and LockBit operations.

Cyware also reported that Lampion's authors were actively trying to make their malware harder to analyze by adding more obfuscation layers and junk code.

Cofense's latest report indicates that Lampion is an active and stealthy threat, and users should be cautious with unsolicited emails asking them to download files, even from legitimate cloud services.

# data[].attributes.attachment_link.title
Lampion malware returns in phishing attacks abusing WeTransfer

# data[].attributes.attachment_link.description
The Lampion malware is being distributed in greater volumes lately, with threat actors abusing WeTransfer as part of their phishing campaigns. WeTransfer is a legitimate file-sharing service that can be used free of charge, so it's a no-cost way to bypass security software that may not raise alerts about the URLs used in emails.

# data[].attributes.headline
Social Engineering and Common Ways it Affects Cybersecurity

# data[].attributes.subject
Social Engineering and Common Ways it Affects Cybersecurity

# data[].attributes.body
Social engineering exploits psychological traits and aspects of human behavior. Often times the bad actor will disguise themselves under the name of a trusted entity and use a made-up, but probable scenario to trick the person into giving personal credentials. These are commonly known as "phising" attacks, and can be hard to distinguish by the average person, especially when the "decoy" website or link is very convincing. Once the attacker creates a link of trust with the victim, the victim can easily fall prey into giving sensitive information to the attacker, which can be used to guess passwords, hack into bank accounts, or other activities with malicious intent. One easy way into recognizing "phising" scams is to always check the URL. URL's from legitimate, trusted sources will always come from the company's website. A "phising" scam might have a link where one or two letters are changed, or there is a dash where there shouldn't be. This is an easy way of saving yourself from falling victim to "social engineering."

# data[].attributes.attachment_caption
Social Engineering (And how it relates to cybersecurity) 

# data[].attributes.headline
Social Engineering (And how it relates to cybersecurity) 

# data[].attributes.subject
Social Engineering (And how it relates to cybersecurity) 