Security News
A persuasive and ongoing series of phishing attacks are using fake Office 365 notifications asking the recipients to review blocked spam messages, with the end goal of stealing their Microsoft credentials. Instead of reaching the Office 365 portal when clicking the 'Review' button, they are sent to a phishing landing page that will ask them to enter their Microsoft credentials to access the quarantined spam messages.
Threat actors are exploiting ProxyLogon and ProxyShell exploits in unpatched Microsoft Exchange Servers as part of an ongoing spam campaign that leverages stolen email chains to bypass security software and deploy malware on vulnerable systems. ProxyLogon and ProxyShell refer to a collection of flaws in Microsoft Exchange Servers that could enable a threat actor to elevate privileges and remotely execute arbitrary code, effectively granting the ability to take control of the vulnerable machines.
In January 2021, law enforcement and judicial authorities worldwide moved together to perform a global takedown of the Emotet botnet, and in April 2021 they performed a coordinated, widespread uninstall of the malware from infected machines via a module they propagated in January, effectively crippling the botnet. According to the researchers, whoever is trying to bring the Emotet botnet back online has started by using the Trickbot botnet to drop the malware, and then added the tried and tested method of sending spam with attachments and links to it.
The Emotet malware kicked into action yesterday after a ten-month hiatus with multiple spam campaigns delivering malicious documents to mailboxes worldwide. Emotet is a malware infection that is distributed through spam campaigns with malicious attachments.
The United States Federal Bureau of Investigation has admitted that a software misconfiguration let parties unknown send email from its servers. A statement from the Bureau, dated November 14th, states that the agency "Is aware of a software misconfiguration that temporarily allowed an actor to leverage the Law Enforcement Enterprise Portal to send fake emails".
Signal has added an easy way for users to report and block spam straight from message request screens with a single mouse click. Message requests were added to Signal last year, in August 2020, to allow new users to reach out to other Signal users even if they're not in their address books and provide more contextual info to those on the receiving end.
Microsoft is working on adding a spam call notification feature to the Microsoft 365 Teams collaboration platform. Once the new feature rolls out, Microsoft Teams will alert Office 365 users when they're receiving what looks like spam calls.
Chipotle.com, the deception would be evident upon examining the raw email header data. "It is important that recipients notice the discrepancy between a sender's display name and its actual email address," wrote Bukar Alibe, cyber security analyst at INKY, in a blog post provided to The Register.
A federal judge in Connecticut today handed down a sentence of time served to spam kingpin Peter "Severa" Levashov, a prolific purveyor of malicious and junk email, and the creator of malware strains that infected millions of Microsoft computers globally. A native of St. Petersburg, Russia, the 40-year-old Levashov operated under the hacker handle "Severa." Over the course of his 15-year cybercriminal career, Severa would emerge as a pivotal figure in the cybercrime underground, serving as the primary moderator of a spam community that spanned multiple top Russian cybercrime forums.
Researchers have seen a new variant of the IcedID banking trojan sliding in via two new spam campaigns. ZIP files full of the malware - or links to such ZIP files - the new twist on the old banking trojan is a tweaked downloader, which the threat actors moved from the initial x86 version to the latest: an x86-64 version.