A new phishing campaign tries to trick email recipients into pasting and executing malicious commands on their system that installs DarkGate malware.
Security researchers at Ahnlab have discovered a new phishing campaign that leverages a unique user interaction. Normally, phishing campaigns simply need users to open an HTML attachment.
But this campaign opens up a fake Word online page with an overlay dialog box asking users to navigate to the Windows Run dialog box, pasting the contents of the clipboard, and pressing Enter.
Source: Ahnlab
The HTML file loads a malicious PowerShell command into the computer’s clipboard and requires the user to help “deliver” to the OS.
The PowerShell command connects the victim’s computer to a web address that then downloads an HTA file.
What makes this method so strange is it seems almost impossible that anyone would fall for it. Start with the URL in the screenshot above – it’s a local C: drive file path. Then take the button name – “How to Fix." It should at very least just say “Fix.”
And yet, we suspect, there will always be someone who doesn’t know any better who will simply do what they’re asked to do and… just like that Ctrl-V has become part of the cyber attack.
Users that undergo continual security awareness training will see right through such poor execution and protect the organization against phishing and social engineering attacks.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
