As if stealing all your credentials, cookies, and email wasn’t bad enough, this new version of QakBot inserts itself into your emails, impersonating you to gain access to more victims.
I’ve covered QakBot before – in fact, just a few months ago where we saw a surge in QakBot’s use jump by 65%. But a new analysis of the most recent version of the banking trojan by security researchers at Sophos details how QakBot has evolved and now wants to spread itself to everyone you know.
Once infected – generally via phishing attack – QakBot accesses the inbox of the victim user and impersonates the compromised account, sending out phishing emails via a Reply to All of all existing email threads. To make the email look more authentic (and as with all Reply to All emails) the original message being replied to is quoted.
Generally, the malicious email content is little more than a brief business message in the recipient native language and a malicious link.
This type of attack is dangerous for two reasons: first the malicious email spreading QakBot is most definitely coming from someone that the recipient is conversing with already (you). And, second, the email thread is a known conversation. The only thing that makes this attack seem out of place is the abrupt “here – look at this document” that should seem out of place. Those employees that undergo continual Security Awareness Training will see a red flag immediately. But, sadly, those users that aren’t taught to be vigilant will likely click the link and further spread QakBot.
Here's how it works:
