Default title

REPOSTED FROM THE KNOWBE4 WEBSITE

We partner with KnowBe4 for obvious reasons

REPOSTED FROM THE ORIGINAL POST AT KnowBe4

Here is the triple-threat scam which was discovered by our friends at Malwarebytes:

Comcast has a search page called Xfininity that serves tons of searches. On this page is a malicious ad (served by Google) from "Sat TV Pro" which claims to compare Direct TV to Comcast TV. The user clicks and gets redirected to a compromised site which has an Exploit Kit (EK) running.

The EK infects first the workstation with ransomware and then redirects to a fake Xfinity site.

The fake Xfinity site pops up a message from "Comcast's security plugin" that the workstation is infected (correct, the bad guys just did that!) and that the user needs to call tech support. The toll free number goes to scammers who will try to charge the user's credit card to "fix" the box.

Dang, they get craftier by the month with these "double payloads" where social engineering, exploit kits, and ransomware are combined. If they don't get you one way they will try to get you the other way. This is a good example of cyber crime gangs cooperating and sharing "revenues" because the toll-free scammers are unlikely to be the same guys as the ransomware team. If you want the technical detail, you can see the flow of the scam at the Malwarebytes blog. This particular scam was reported to Google and Comcast, but there will be other scams very similar to this one. The bad guys have whole campaigns stacked up with attacks like this, and it's like whack-a-mole.

So I would send the following out. Feel free to copy/paste/edit this Scam Of The Week and email it to your employees, friends and family.

"More and more, legit-looking advertising served on major websites turns out to be malicious. Bad guys pay for and posts ads that they hope you will click on. But if you click on those ads, you get redirected to a compromised website. That malicious site might infect your computer with ransomware, and/or display popups that claim your PC has a virus and tell you to dial a toll-free number. If you call that number it will be answered by scammers who claim they are Microsoft but will try to charge your credit card to fix your computer. What to do? You need to stay vigilant at all times and "Think Before You Click":

Don't click on links in emails but go to the website you want to visit using your browser.
Do not click on display ads on websites but go to the website you want to visit using your browser.

If you get popups that claim your computer has a virus and you need to dial a toll-free number, close your browser, and if this happens in the office, call the IT helpdesk.

In the office, IT will update your computer with the latest versions of software, but at the house you also need to update your applications to their latest versions. If you don't do that, and you wind up on a compromised website, it will try to install malware on your computer. Remember, both in the office and at the house, you need to "Think Before You Click".

Talk to ALT8 about your mobile device security concerns. We would be happy to review your current policies and help you evaluate and understand your risks.

Visit KnowBe4

RECENT THREAT POSTS

- Elizabeth Montalbano
Phishing Campaign Dangles SharePoint File-Shares
Attackers spoof sender addresses to appear legitimate in a crafty campaign that can slip past numerous detections, Microsoft researchers have discovered.
- Lisa Vaas
We COVID-Clicked on Garbage, Report Finds: Podcast
Were we work-from-home clicking zombies? Steganography attacks snagged three out of eight recipients. Nasty CAPTCHAs suckered 50 times more clicks during 2020.
- Becky Bracken
Iranian APT Lures Defense Contractor in Catfishing-Malware Scam
Fake aerobics-instructor profile delivers malware in a supply-chain attack attempt from TA456.
- Tara Seals
Ransomware Volumes Hit Record Highs as 2021 Wears On
The second quarter of the year saw the highest volumes of ransomware attacks ever, with Ryuk leading the way.
- Tom Spring
Raccoon Stealer Bundles Malware, Propagates Via Google SEO
An update to the stealer-as-a-service platform hides in pirated software, pilfers crypto-coins and installs a software dropper for downloads of more malware.
- Elizabeth Montalbano
‘DeadRinger’ Targeted Exchange Servers Long Before Discovery
Cyberespionage campaigns linked to China attacked telecoms via ProxyLogon bugs, stealing call records and maintaining persistence, as far back as 2017.
- Lisa Vaas
‘PwnedPiper’: Devastating Bugs in >80% of Hospital Pneumatics
Podcast: Blood samples aren’t martinis. You can’t shake them. But bugs in pneumatic control systems could lead to that, RCE or ransomware.
- Becky Bracken
Chipotle Emails Serve Up Phishing Lures
Mass email distribution service compromise mirrors earlier Nobelium attacks.
- Becky Bracken
NSA Warns Public Networks are Hacker Hotbeds
Agency warns attackers targeting teleworkers to steal corporate data.
- Elizabeth Montalbano
Novel Meteor Wiper Used in Attack that Crippled Iranian Train System
A July 9th attack disrupted service and taunted Iran’s leadership with hacked screens directing customers to call the phone of Iranian Supreme Leader Khamenei with complaints.

Archives

Leave a Reply

Your email address will not be published. Required fields are marked *

17 − thirteen =