A phishing campaign is using fake NortonLifelock documents to trick victims into installing a remote access tool, according to researchers at Palo Alto Networks’ Unit 42. The documents state in large text, “You have received a protected document which contains personal information. To enter your password please Enable Macros.”
The researchers didn’t observe the phishing email itself, but they surmise that it instructed the recipients to open the document and then enter a password provided in the email. That password was presumably the letter “C,” since the macro would first trigger a password dialogue box that only accepted an uppercase or lowercase “C.”
If the user chooses to enable macros and then enters this password, a Visual Basic script will trigger a series of processes that will result in the installation of the NetSupport remote access tool. NetSupport is a legitimate tool that’s used by IT administrators to control computers remotely, but in the hands of an attacker, it can be used maliciously.
The researchers later identified additional files that appeared to be part of this campaign, which gave them more insight into the phishing lures themselves.
“Beginning at the end of November and continuing into January 2020, the mail attachments changed and were instead named as <target company website>.doc and sent from email addresses using domains that were registered within one day of the observed activity,” they write. “The email subjects contained the same trend reusing themes associated with refunds, as well as transaction and order inquiries.”
It’s worth noting that the password dialogue step in this scheme was only included to make the victim less suspicious: the macro could have installed malware immediately after the user clicked “Enable Content.” As long as users know about this tactic, they can avoid falling for these attacks regardless of how persuasive the attackers are. New-school security awareness training can familiarize your employees with social engineering strategies so they can spot these techniques.
Palo Alto Networks Unit 42 has the story: https://unit42.paloaltonetworks.com/cortex-xdr-detects-netsupport-manager-rat-campaign/
Here's how it works:
