Date:06/10/20
The antivirus firm Sophos has observed two new phishing campaigns in the wild that use a new trick to help them avoid detection.
Email phishing scams typically employ a three-stage process to get potential targets to give up their credentials which begins with an email that contains a URL they want users to click through. Clicking on this link will bring potential victims to a fake login page where their credentials are harvested and then sent to another site where the cybercriminals behind the campaign will use them to takeover user accounts.
However, these two new phishing campaigns, one of which Sophos received directly and one was reported by a reader, also use this same three-stage process but with a slight twist.
By attaching the URL of their phishing sites to emails, the cybercriminals behind these new campaigns are increasing the likelihood that a victim would open their fake web pages. This is because opening an attachment doesn't feel nearly as dangerous since it's not a document that could contain macros, a PowerShell file or an executable program.
Theoretically, opening an HTML attachment should simply open up the enclosed web page in the safety of a browser's sandbox just as if a victim had clicked on a link. However, by using an HTML attachment, users are unable to check out the link in advance to look for a fake or suspicious domain name and the URL in the address bar appears as if it were a local filename.
Sophos warned about the dangers of opening HTML attachments in a new blog post, saying:
“There are other reasons not to open HTML attachments, notably to do with JavaScript. For safety’s sake, script code inside HTML emails is stripped or blocked when any modern email reader displays the message. That’s a precaution that email software introduced decades ago when self-spreading script viruses such as Kakworm literally spread everywhere. Kakworm’s script code would activate and the virus would spread as soon as the email was displayed, without waiting for you to click any further. When you open an HTML attachment, however, it is no longer under the strict controls of your email client software, and any JavaScript inside the HTML will be allowed to run by default by your browser.”
To avoid falling victim to these new phishing campaigns, Sophos recommends that users avoid HTM or HTML attachments altogether, never log in to web pages that you arrived at from an email, turn on 2FA when possible, change passwords once you believe you've been phished and use a web filter.
This new linkless phishing scam is even tricking tech experts
The antivirus firm Sophos has observed two new phishing campaigns in the wild that use a new trick to help them avoid detection.Email phishing scams typically employ a three-stage process to get potential targets to give up their credentials which begins with an email that contains a URL they want users to click through. Clicking on this link will bring potential victims to a fake login page where their credentials are harvested and then sent to another site where the cybercriminals behind the campaign will use them to takeover user accounts.
However, these two new phishing campaigns, one of which Sophos received directly and one was reported by a reader, also use this same three-stage process but with a slight twist.
- We've put together a list of the best malware removal software
- These are the best internet security suites on the market
- Also check out our roundup of the best endpoint protection software
By attaching the URL of their phishing sites to emails, the cybercriminals behind these new campaigns are increasing the likelihood that a victim would open their fake web pages. This is because opening an attachment doesn't feel nearly as dangerous since it's not a document that could contain macros, a PowerShell file or an executable program.
Theoretically, opening an HTML attachment should simply open up the enclosed web page in the safety of a browser's sandbox just as if a victim had clicked on a link. However, by using an HTML attachment, users are unable to check out the link in advance to look for a fake or suspicious domain name and the URL in the address bar appears as if it were a local filename.
Sophos warned about the dangers of opening HTML attachments in a new blog post, saying:
“There are other reasons not to open HTML attachments, notably to do with JavaScript. For safety’s sake, script code inside HTML emails is stripped or blocked when any modern email reader displays the message. That’s a precaution that email software introduced decades ago when self-spreading script viruses such as Kakworm literally spread everywhere. Kakworm’s script code would activate and the virus would spread as soon as the email was displayed, without waiting for you to click any further. When you open an HTML attachment, however, it is no longer under the strict controls of your email client software, and any JavaScript inside the HTML will be allowed to run by default by your browser.”
To avoid falling victim to these new phishing campaigns, Sophos recommends that users avoid HTM or HTML attachments altogether, never log in to web pages that you arrived at from an email, turn on 2FA when possible, change passwords once you believe you've been phished and use a web filter.
Views: 177
©ictnews.az. All rights reserved.
Similar news
- Azerbaijani project to monitor disease via mobile phones
- Innovative educational system to be improved under presidential decree
- NTRC prolongs license of two TV and radio organizations for 6 years
- Azerbaijan establishes e-registry for medicines
- Azerbaijani museum introduces e-guide
- Nar Mobile opens “Nar Dunyasi” sales and service center in Siyazan city
- International conference on custom electronic services held in Baku
- OIC secretary general to attend COMSTECH meeting in Baku
- Azerbaijan develops earthquake warning system
- New law to regulate transition to digital broadcasting in Azerbaijan
- Azerbaijani State Social Protection Fund introduces electronic digital signature
- Intellectual traffic management system in Baku to be commissioned in December
- Tax Ministry of Azerbaijan started receiving video-addresses
- World Bank recommends Azerbaijan to speed up e-service introduction in real estate
- Azerbaijan to shift to electronic registration of real estate
