10 Jun Phishing in the clouds
15 Oct OWA Phish - a new vector
Join our blog
You can contribute to our blog if you have +100 points. Comment on articles and blogposts, and other users will rate your comments. You receive points for positive ratings.
We recently noticed a mass mailing among the general flow of spam that at first glance looked just like the usual “forum” junk mail that appears on forums and bulletin boards, and which are sent as email notifications to users of those forums.
Today we came across a new, very sophisticated type of phishing. The user receives a message that, at first glance, appears to be from McDonald's. It states that the recipient has won the chance to participate in a survey and immediately receive remuneration of $80 for doing so.
Recently the security of public cloud services has been a major topic of discussion on the Internet. While service providers assure us that there’s nothing safer than the ‘cloud’, security companies have already managed to discover various kinds of threats in the cloud.
In the meantime, spammers are managing to keep up and have started making more active use of free remote resources. For instance, we recently came across the following phishing messages for harvesting email passwords:
It’s February, and that means Valentine’s Day-related spam. Lots of it! There are already loads of adverts offering expensive alcohol and chocolates, jewellery and leather goods, romantic trips for two etc.
Other goods that are traditionally advertised in spam, such as fake designer watches and Viagra, have also exploited the Valentine’s Day theme to grab the attention of email recipients. The spammers appear convinced that there’s no better time than 14th February to increase your libido or buy cheap replicas of designer watches:
So far, this year’s Valentine’s Day spam has been mostly harmless, but we would like to warn our readers once again that the first half of February usually sees a surge in malicious links appearing in emails that appear to be for virtual greeting cards. So, be careful if you receive an e-card – make sure it has come from a genuine source before clicking any links.
Kaspersky Lab will be following developments closely in the run-up to Valentine’s Day.
Yesterday we saw a phishing attack targeting users of Outlook Web Access (OWA) service – used worldwide to access email from Microsoft Exchange Servers via the Internet. Users received emails which told them that a security upgrade required them to apply new settings by clicking on the enclosed link.
This is a typical phishing text, but the criminal used domain spoofing to make the email seem as if it came from the recipient’s own domain. In reality, by clicking on the link victims landed on a phishing page which only looked like a standard OWA page.
Once on the phishing page, the user was asked to download an .exe file in order to update security settings. Instead of security updates, the victims were installing a Zbot Trojan (Trojan-Spy.Win32.Zbot family).
Interestingly enough, all of the phishing domains were in the .eu and .co.uk zones – which is actually a rare case, since most phisher domains are located in Third World countries.
OWA is a popular service in the business community today so the phishers are likely to reach significant numbers of people. Once again, we remind people to check emails carefully before clicking on links – and recommend network admins to warn their users about this attack.