New Phishing Campaign Spoofs DocuSign

New Phishing Campaign Uses DocuSign to Bypass Email Gateway

New phishing campaigns have been seen to spoof DocuSign, a digital document signature platform, in order to steal credentials. These phishing emails redirect to malicious fake login pages for a variety of email platforms, where victims are prompted to enter their email credentials. This is yet another example of attackers piggybacking off of the credibility of legitimate organizations, in order to give their attacks an air of legitimacy.

Recommendations

• Enable multi-factor authentication for all accounts to prevent potential account takeover
• Always verify the sender of suspicious or unexpected emails
• Never download attachments from unknown senders or suspicious email
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for those entities. Reach out to [email protected] for assistance, if needed

Details

A new phishing campaign has been identified, leveraging DocuSign in orer to bypass email gateway and steal credentials. DocuSign is a popular signature software often used in digital signing of legal documents. Lure documents associated with this campaign spoof legitimate DocuSign emails very well, making the attack difficult to detect.

Example of a phishing email spoofing legitimate DocuSign emails

The link embedded in these emails, however, is not to DocuSign, but an attacker-controlled phishing domain.

Example phishing landing page, when link in email is clicked

Each of these options directs to a phishing page spoofing the log in for the email provider chosen. These pages are used to harvest credentials and compromise email accounts, which can be used in other attacks.

Breaking News - 08.08.2019

Varenyky: Spambot à la Française

Malware targeting French organizations has been on the rise since May 2019. Two of the most prominent of these campaigns are a malvertising campaign, which redirects victims to malicious ads, and a sextortion campaign. This malware is generally spread through email.

See the full report here: https://www.welivesecurity.com/2019/08/08/varenyky-spambot-campaigns-france/

The Curious Case of a Fileless TrickBot Infection

Researchers at IBM have observed recent changes to the TrickBot banking trojan. New versions of this malware, specifically the ones targeting 64-bit Windows 10 machines, are now completely fileless, making it more difficult for AV to detect. TrickBot first appeared on the scene in 2016, and since then, has continued to steal banking credentials.

See the full report here: https://securityintelligence.com/posts/the-curious-case-of-a-fileless-trickbot-infection/

MoqHao Related Android Spyware Targeting Japan and Korea Found on Google Play

Korean and Japanese Android users are at risk from a new family of malware. A new campaign called MoqHao, has been disguising itself as security and police apps on the Google play store. These applications are actually spyware, which seeks to exfiltrate information about the victim for the attacker.

See the full report here: https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/moqhao-related-android-spyware-targeting-japan-and-korea-found-on-google-play/

New SWAPGS Side-Channel Attack Bypasses Spectre and Meltdown Defenses

A new side-channel attack against Intel microprocessors has been released, which can bypass all mitigations put in place for the Spectre and Meltdown attacks.To successfully exploit this, however, an attacker would need access to data stored in memory, which is unlikely unless the system is already compromised in some way.

See the full report here: https://threatpost.com/new-swapgs-side-channel-attack-bypasses-spectre-and-meltdown-defenses/147034/