Cybercriminals are using call centers to trick users into downloading the BazarLoader malware, according to researchers at Palo Alto Networks’ Unit 42. By relying on social engineering to convince users to install the malware themselves, the attackers don’t have to worry about malicious emails being blocked by security filters.
“In early February 2021, researchers began reporting a call center-based method of distributing BazarLoader,” Unit 42 says. “This method utilizes emails with a trial subscription-based theme that encourages potential victims to call a phone number. A call center operator then answers and directs victims to a website to unsubscribe from the service. Call center operators offer to personally guide victims through a process designed to infect vulnerable computers with BazarLoader.”
The emails inform users that their credit card will be charged unless they call the number in the email to cancel their subscription. During the ensuing conversation, the scammer convinces the user to download an Excel file that supposedly contains a confirmation code. When the user opens this file and enables macros, their computer will be infected with BazarLoader.
The researchers note that BazarLoader is then used to deploy additional, more damaging malware like Trojans or ransomware.
“BazarLoader provides backdoor access to an infected Windows host,” they write. “In some cases, Cobalt Strike is seen as follow-up malware, leading to other malware like Anchor. At least two cases have been publicly documented where BazarLoader malware led to Cobalt Strike and then to Anchor malware. One case happened in February 2021, and the other case happened in March 2021. However, BazarLoader is not limited to just Cobalt Strike and Anchor as follow-up malware. 2020 saw reports of BazarLoader leading to ransomware like Ryuk. Backdoor access to an infected Windows host could lead to any family of malware.”
New-school security awareness training can help your employees thwart phishing attacks by teaching them how to recognize social engineering tactics.
Palo Alto Networks’ Unit 42 has the story.
Here's how it works:
