Resources

Blog

Why Your Users Keep Falling for Phishing Scams

We’ve all been there. That awful moment, when you realize it’s happened again. “Why do they never learn?” You ask yourself. “It really isn’t that hard!” Time and time again, your users click on malicious links and attachments in phishing emails, and it seems like no matter what you do to improve their awareness, it never gets any better. So why do they keep falling for phishing scams? Is it...
Blog

When Good Websites Turn Evil: How Cybercriminals Exploit File Upload Features to Host Phishing Sites

Compromised websites are an integral part of the cybercrime ecosystem. They are used by cybercriminals to host a wide range of malicious content, including phishing sites, exploit kits, redirects to other malicious sites, and other tools needed to carry out attacks. Why? One reason is because there is an abundance of insecure websites around the world that can be easily compromised. Another...
Blog

Alma Ransomware: Analysis of a New Ransomware Threat (and a decrypter!)

With low overhead and risk of prosecution, ransomware attacks have outpaced banking Trojans in sheer number of incidents, if not profit. Ransomware’s rapidly growing popularity has spawned dozens of variants, subtypes, and families as threat actors seek to outmaneuver researchers and competitors. In this dynamic threat landscape, alongside monitoring the established ransomware families for any...
Blog

Google AdWords Used in Bitcoin, Banking, and Online Gambling Phishing Campaigns

Hackers targeting bitcoin wallet users are once again leveraging Google’s AdWords in their most recent campaigns. Phishlabs has previously seen similar attacks against banks and online gambling sites over the past year. Some of the most recent attacks have targeted Blockchain and Kraken and have been widely blogged and tweeted about over the past week. As seen in the screenshot below, a Google...
Press Release

Three more firms hit by targeted phishing attacks seeking W2 data

It’s happened again. Scammers have leveraged Phishing to gain access to W2 information at several firms, including technology powerhouse Seagate. No company is immune to these types of social attacks, and organizations both large and small have become victims to a finance-based scheme that has a long reach. Last week, Sunday in fact, Snapchat disclosed that someone had posed as the company’s CEO...
Blog

Olympic Vision Keylogger and BEC Scams

During a recent analysis of a business email compromise (BEC) scam, we observed a lure attempting to install the Olympic Vision Keylogger. Further research determined that this keylogger and the accompanying Olympic Vision Crypter were used in a larger campaign, targeting multiple organizations using a variety of different lures, including invoice lures and shipment confirmation lures. This...
Blog

Building a Business Case for Effective Security Awareness Training

Security education programs are sometimes mandated, always important, and often difficult to justify the investment. It is easy to get the powers that be to sign off on a once-per-year security awareness training program that will satisfy compliance requirements, but we all know by now that compliance does not equal security. The Information Security Forum (ISF) has defined information...
Press Release

The Hunt for the Financial Industry’s Most-Wanted Hacker

From Bloomberg The malware known as ZeuS and its rogue creator have been at the cutting edge of cyber-crime for nearly a decade. With repeated enhancements, ZeuS and its offspring became juggernauts of cyber bank robbery—turning millions of computers into global networks of zombie machines enslaved by criminals. Conservative estimates of their haul reach well into hundreds of millions of dollars...
Blog

The unrelenting evolution of Vawtrak

In a recent blog post, we wrote about Vawtrak expanding targets and gaining momentum. Fast forward a few months and the threat is anything but diminishing. Sophos just released a technical report on Vawtrak which discusses the significance of the threat and its Crimeware-as-a-Service model. In December 2014, Vawtrak version 0x38 was released including significant code and configuration changes...
Blog

Fraudsters Take Advanced Fee Scams to the Next Level

We've all seen them before. The late prince Abdul has left us millions in inheritance and we need only provide a minor convenience fee to receive the funds. Advanced fee scams are nothing new and have been circulating the Internet since its inception. Until now, scammers have relied on email correspondence and convincing legal jargon to con victims out of their hard-earned dollars. Recently,...
Press Release

Source Code of Android RAT Dendroid Leaked Online

From SecurityWeek. The complete source code for the Android remote access Trojan (RAT) called Dendroid has been leaked online, which researchers from PhishLabs have found contains several vulnerabilities. “The lack of user input validation in Dendroid’s control panel is severe, especially when you consider the level of operational security needed in even smaller crimeware campaigns,” PhishLabs...
Blog

Vulnerabilities found in Dendroid mobile Trojan

On Friday, the full source code of the Dendroid Remote Access Trojan (RAT) was leaked. Dendroid is a popular crimeware package that targets Android devices and is sold on underground forums for $300. Usually the source code for botnet control panels is encrypted, so it was surprising to find the full source code for the Dendroid control panel included in the leaked files. Analyzing the leaked...
Blog

Phishing Takedown Anti-Phishing Phishing Protection

Phishing is a prevalent problem for businesses, particularly financial institutions. Over the years, many services have emerged to help organizations address phishing attacks that are targeting their customers' accounts. When seeking solutions, businesses find they have several options to choose from. These fall into three categories: Phishing takedown services Anti-phishing services ...
Press Release

Article – MitM attackers posing as banks, other major groups, tough to detect

From SC Magazine: Hackers are compromising online banking and social media users in a man-in-the-middle (MitM) attack campaign that involves posing as major organizations – and they are doing it without setting off alerts, according to researchers with PhishLabs. More than 70 recognizable financial organizations around the globe have been targeted so far in the campaign, according to PhishLabs...
Blog

New Man-in-the-Middle attacks leveraging rogue DNS

New MitM attacks impersonate banking sites without triggering alerts PhishLabs has observed a new wave of "Man-in-the-Middle" (MitM) attacks targeting users of online banking and social media. Customers of more than 70 different financial institutions are being targeted. In these attacks, hackers use spam to deliver malware that changes DNS settings and installs a rogue Certificate Authority...
Blog

“Your ACH Transaction” Spam Leads to Malware

PhishLabs has discovered a new malware campaign which appears to be an alert from NACHA regarding a failed ACH transaction. If a vulnerable user clicks the enclosed link, they will be infected with malware. Users receive an email message which appears as follows: From: [email protected] [mailto:[email protected]] Sent: Thursday, February 24, 2011 9:47 AM To: Denise Muns Subject: Your ACH transaction The...
Blog

Advancements in Phishing Redirector Scripts

Almost since the beginning of phishing, attackers have created simple webpages that redirect users to another URL that contains the actual phishing form. They do this for several reasons. In case their phishing site is shutdown, they can simply change the destination of the redirect to point to another phishing site. This means that everyone who receives an email with the redirector link and...