Anti-Virus, Identity Protection Phishbait

iStock-1090872318A phishing campaign is using fake NortonLifelock documents to trick victims into installing a remote access tool, according to researchers at Palo Alto Networks’ Unit 42. The documents state in large text, “You have received a protected document which contains personal information. To enter your password please Enable Macros.”

The researchers didn’t observe the phishing email itself, but they surmise that it instructed the recipients to open the document and then enter a password provided in the email. That password was presumably the letter “C,” since the macro would first trigger a password dialogue box that only accepted an uppercase or lowercase “C.”

If the user chooses to enable macros and then enters this password, a Visual Basic script will trigger a series of processes that will result in the installation of the NetSupport remote access tool. NetSupport is a legitimate tool that’s used by IT administrators to control computers remotely, but in the hands of an attacker, it can be used maliciously.

The researchers later identified additional files that appeared to be part of this campaign, which gave them more insight into the phishing lures themselves.

“Beginning at the end of November and continuing into January 2020, the mail attachments changed and were instead named as <target company website>.doc and sent from email addresses using domains that were registered within one day of the observed activity,” they write. “The email subjects contained the same trend reusing themes associated with refunds, as well as transaction and order inquiries.”

It’s worth noting that the password dialogue step in this scheme was only included to make the victim less suspicious: the macro could have installed malware immediately after the user clicked “Enable Content.” As long as users know about this tactic, they can avoid falling for these attacks regardless of how persuasive the attackers are. New-school security awareness training can familiarize your employees with social engineering strategies so they can spot these techniques.

Palo Alto Networks Unit 42 has the story:

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Ransomware Has Gone Nuclear Webinar

Get the latest about social engineering

Subscribe to CyberheistNews