A Phishing Attack That Delivers Three Forms Of Malware

A phishing campaign targeting Microsoft Windows users delivers three different forms of malware, all designed to steal sensitive information from victims. 

Cyber security researchers at Fortinet have released information regarding a phishing campaign targeting Microsoft Windows users. The phishing campaign leverages three different forms of malware, all of which are designed to steal sensitive information and credentials from victims. 

The malware types used in the campaign are AveMariaRAT, BitRAT, and PandoraHVNC, a trojan malware. By inserting malicious links into the phishing emails, the attackers are able to harvest usernames, passwords, and bank details entered by the victims.

According to Fortinet, the BitRAT malware is especially dangerous as it possesses the capacity to take full control of infected Windows systems, including access to the camera, audio and crypto mining abilities. 

The initial phishing message is designed to appear as though the target is receiving a payment from a trusted source. The message also requests that the target open an attached Microsoft Excel document. However, Fortinet says that the file contains malicious macros and that Microsoft Excel flags the document as a potential security concern.

Users should be wary of unexpected emails claiming to contain vital information hidden in attachments, particularly if that attachment requires you to enable macros first. If the email claims to come from a college or business associate, you should contact them using a different method than email to verify who sent the email. 

Just as fishing lures used to catch fish have grown more sophisticated, so have techniques used to perpetrate phishing. Increasingly, “phishing” emails do more than just impersonate a bank in the effort to steal consumers’ information. Thieves may send a spam email message, instant message, or pop-up message that infects the consumer’s PC with spyware or ransomware and gives control of it to the thief. 

A spam message may infect your computer when you click a link or picture in the spam message, or when you open an attachment to a spam message. If your PC is poorly secured, it may be infected as soon as you open the spam message itself.

Businesses can also help employees avoid falling victim to phishing emails by using appropriate anti-spam and anti-virus software, as well a training users on how to spot and report phishing emails. 

Fortinet:      Oodaloop:      ZDNet:     US Business Reviews:    Flipboard:      

You Might Also Read: 

Some Apps Come Loaded With Malware: