New Qbot Phishing Attack Pretends to be Windows Defender to Trick Its Victims



QBot Phishing AttackOne of the most dangerous pieces of malware is back with a new campaign that takes advantage of social engineering techniques to look convincing enough to fool your users.

The last thing you want to hear when you ask “so what malware hit us?” is “Qbot. This is really nasty malware that steals just about everything off of the infected computer and can leave the door open for attackers to come back into your network whenever they want.

A newly spotted campaign uses some pretty convincing use of graphics and impersonation of Microsoft’s Windows Defender to trick victims into enabling an email attachment used as the initial dropper.

Traditionally, phishing campaigns involving Qbot revolve around invoices, payment documents, and other financial-related concerns. Excel (.xlsx) files are typically used as the attachment to take advantage of the well-used macros functionality built into Office applications.

What makes this attack so interesting is the contents of the Excel document. The bad guys need the victim to enable macros, and (we hope) users won’t normally fall for this. But this latest attack uses a well-thought out presentation to convince the user it’s ok to enable macros:

windows-defender-template

Pretending to be Windows Defender and using some security vendor logos to help establish credibility that it's "ok" to enable macros, Qbot has a very good chance of successfully fooling the unsuspecting user.

And once macros are enabled, it’s game over.

Users need to be taught via Security Awareness Training that Office documents with attachments should never have macros enabled (unless the user operates in a business function where macros are needed, in which case, every email should be opened with a dose of suspicion).


Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-security-test-offer



Subscribe To Our Blog


Comprehensive Anti-Phishing Guide




Get the latest about social engineering

Subscribe to CyberheistNews