This phishing attack hijacks email chains to power up an ancient botnet

A new email phishing campaign has been spotted looking to compromise additional endpoints for the Qakbot botnet. 

Qakbot has been around for almost 15 years, haivng reinvented itself on multiple occasions throughout its life, and is now hijacking people’s email threads to distribute the payload to more devices.

Cybersecurity researchers from Sophos discovered once Qakbot infects a device, it delivers a payload that scans it for email accounts and its login credentials. If it is successful, it will go through the inbox and send out replies to every available email threat (as opposed to just sending out a new email to all contacts). The reply will carry a quote of the original message, as well as a malicious payload in the attachment.

TechRadar needs you!

We're looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn't take more than 60 seconds of your time, and entrants from the UK and US will have the chance to enter a draw for a £100 Amazon gift card (or equivalent in USD). Thank you for taking part.

>> Click here to start the survey in a new window <<

Multi-stage attacks

By replying to an ongoing thread, instead of sending out a new email, the threat actor hopes to lower the guard of the victim. People may be vigilant when receiving shady emails out of the blue, but when they get a reply, from a known contact, in an ongoing thread, they might be more inclined to examine the contents of the attachment.

Besides English, the lure can be sent out in multiple other languages, Sophos warns, depending on the language of the original email thread.

Quakbot’s real danger, however, lies in the fact that it can serve as the stage-one malware in a multi-stage attack. It can deliver other, more sinister payloads, such as ransomware. 

Read more

> What is phishing and how dangerous is it?

> Watch out - that PayPal email could be a phishing attack

> Microsoft replaced as the most-phished company by a surprising entrant

"Qakbot is a full-service botnet that performs data theft and malware delivery services on behalf of either themselves or third parties. They clearly take advantage of credential theft to access the websites belonging to innocent third parties to use for hosting payloads," Andrew Brandt, principal researcher at Sophos Labs told ZDNet. 

As usual, users are advised to be extra cautious when receiving emails with attachments, regardless of who the sender is.

• Check out our rundown of the best identity theft protection services right now

Via: ZDNet

from TechRadar - All the latest technology news https://ift.tt/zJQElYF