ZeroFox Daily Intelligence Brief - February 21, 2023

ZeroFox Daily Intelligence Brief - February 21, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• New Stealc Malware Emerges with a Wide Set of Stealing Capabilities
• Microsoft Outlook Flooded with Spam Due to Broken Email Filters
• Coinbase Cyberattack Targeted Employees with Fake SMS Alert

New Stealc Malware Emerges with a Wide Set of Stealing Capabilities

Security researchers have observed an information-stealing malware strain called Stealc being extensively marketed on the dark web. This stealer, which borrows features from popular malware such as Vidar, Raccoon, Mars, and Redline, is equipped with a customizable file grabber to target specific file types as per the user’s requirements. The ease of use provided by this info-stealer makes it likely to be widely used by less sophisticated threat actors.

Recommendations:

• Use the ZeroFox Intelligence Search to remain up-to-date on emerging threats and corresponding indicators of compromise.
• Avoid downloading software from illegitimate sources to protect your systems from being infected with malware.

Microsoft Outlook Flooded with Spam Due to Broken Email Filters

A widespread Outlook spam-filter malfunction has led to users’ inboxes being bombarded with spam emails. Microsoft Outlook’s filtering service was dysfunctional to such an extent that the problem was not solved even after selecting "Only trust email from addresses in my Safe Senders and domains list and Safe mailing lists" in Junk Mail > Filters.

Microsoft has informed some users that the spam problem has been fixed, but the cause of the problem has not yet been disclosed.

Recommendations:

• Users should be especially cautious about clicking on links in emails, as threat actors might leverage this absence of spam filters to send phishing emails.
• Follow ZeroFox Intelligence for updates and advisories.

Coinbase Cyberattack Targeted Employees with Fake SMS Alert

A phishing attack at cryptocurrency company Coinbase led to the theft of some employees’ personal details, including names, email addresses, and phone numbers. The company stated that no funds were stolen and no customer information was affected in the breach. The attack methodology—involving SMS-based phishing followed by a phone call to the target employee—resembles that used in several prominent data breaches that took place last year, such as in Twilio and MailChimp.

Recommendations:

• Coinbase advises other companies to monitor web traffic from the company's technology assets to specific addresses—including sso-.com, -sso.com, login.-sso.com, dashboard-.com, and *-dashboard.com—to mitigate such attacks.
• Security personnel should monitor attempts to install remote desktop viewers and the EditThisCookie browser extension.
• Employees should never share their log-in credentials and multifactor-authentication (MFA) token in response to requests over SMS or phone calls and be generally cautious about requests for confidential information.