[Heads-Up] Warn Your Employees. This Is the Year That Sextortion Spear Phishing Is Skyrocketing…

The post [Heads-Up] Warn Your Employees. This Is the Year That Sextortion Spear Phishing Is Skyrocketing.. appeared first on Infinity Network Solutions.

We’ve seen it time after time, malicious actors routinely attempt to confuse recipients of messages with obscure or lesser-utilized file extensions.

Over the past month, some phishing attempts using xps files instead of the typical pdf or doc/docx formats have been captured by our filters.  The xps file format is Microsoft’s alternative to pdf files.  Windows machines with Vista or later operating systems natively support this extension with Windows xps file viewer.  Actors have started taking advantage of this lesser-utilized format for their phishing campaigns.

Phishing Examples

Our SecureTide email filtering has captured a wide range of these phishing messages.  So far, they appear to be attributed to threat actors currently conducting Business Email Compromise (BEC) attacks.  Attacks originate from legitimate (compromised) senders with the similar techniques, tactics, and procedures.  Below is an example which could easily dupe unsuspecting users.

Viewing the XPS File

Users should not open or view unsolicited attachments, even from a known sender without intense scrutiny and/or verification.  Scammers do exploit the trust that known contacts share.  Hopefully a user will never see one of these, however, this is what these attached files look like when opened in an isolated test environment.

Linked Phishing Portals

If the user happens to click on the link in the attached xps file (pictured above), below is an example web phishing portal they might encounter.  For this particular one, the first screen requests their email address.  If they proceed with entering it, the next image shows the resulting page requesting their email credentials.

 After entering email address:

Filter Evasion Techniques

Malicious actors are attempting to use filter evasion techniques.  They break up the suspicious phishing text via canvas clip mappings inside deeply embedded fpage files.  An image portion below displays how they used multiple canvas clip mappings to stitch together the words, “open with your professional email login credentials.”

Minimal Anti-Virus Signatures for XPS Files

Most anti-virus engines do not have many phishing rules setup for the xps extensions like they would for more commonly used ones.  We can see this example received 0/60 hits when processed thru a popular anti-virus engine aggregator.

AppRiver Protection

There is no shortage of spam, malware, phishing, or nefarious websites AppRiver’s staff and systems continuously protect and defend against. Malicious actors work around the clock, therefore, we at AppRiver work even harder to stay one step ahead. Our team is here 24/7 365 days a year protecting and supporting clients and partners from security threats.

POSTED BY DAVID PICKETT IN DIGITAL DEGENERATE, PHISHING, SECURETIDE, SECURITY RISKS, TECH NEWS

https://blog.appriver.com/2018/05/bec-attacks-evolve-to-phishing-via-xps-files-appriver

The post Attacks Evolving – Phishing via XPS Files appeared first on Infinity Network Solutions.

They remained a steady tactic used by cybercriminals throughout the first half of 2017, according to the Phishing Activity Trends Report recently released by the Anti-Phishing Working Group (APWG), an international coalition of industry, government, law enforcement and nongovernmental organizations.

In phishing attacks, scammers use fraudulent websites and false emails. Perpetrators attempt to steal personal data, most commonly passwords and credit card information.

The number of unique phishing email campaigns averaged around 98,000 per month in the first half of 2017, with a spike of 121,000 in March. The spike may have been tied to an upswing in the W-2 email phishing scam that the IRS warned about in February. The APWG report contained a number of interesting insights on phishing activity so far this year.

Those launching phishing attacks continued a years-long trend of focusing on only a few hundred companies at a time. This limited scope reflects the additional time and money needed to carry out a successful phishing attack.

Those organizations in the bullseye are attacked on a regular basis from every few weeks to every day, with a small group of firms being targeted more intermittently.

The Industries Targeted Most by Phishing

Among industries targeted by phishing cybercriminals, the payment industry was in the crosshairs 45 percent of the time, with the financial industry and Software as a Service/webmail industry filling out the top three at 16 percent and 15 percent, respectively.

This is a big upsurge in focus on the payment industry, which accounted for only 11 percent of phishing attacks in the fourth quarter of 2016, according to an earlier APWG report.

Attackers are increasingly using free hosting providers as one of the resources to build their campaigns, notes APWG contributor Crane Hassold, manager of threat intelligence for PhishLabs.

“These free hosts are not only easy and cheap to use, but they also allow threat actors to create subdomains spoofing a targeted brand, resulting in a more legitimate-looking phishing site,” Hassold says in the APWG report.

While the total numbers of free hosting-based attacks increased from 1,323 in January to 1,939 in June, the use of free hosting services continued to trend at about 10 percent of the total number of attacks each month.

APWG contributor Axur, a digital risk monitoring company located in Brazil, notes the heavy use of social media platforms such as Facebook, Instagram, LinkedIn and YouTube as phishing attack vectors in South America. Many of these attacks involve users being served up fake login pages that collect username and password information. These platforms accounted for about 39 percent of all phishing attacks among Latin American countries in the second quarter of 2017.

Alexander Slagg, Biz Tech, www.biztechmagazine.com

The post Why Phishing Attacks Persist Despite Increased Awareness appeared first on Infinity Network Solutions.