Cybersecurity researchers have discovered that malicious actors are successfully spoofing sender email addresses in malspam campaigns. By faking the sender address, these bad actors aim to make the emails appear more legitimate and bypass security measures that could flag them as malicious. While there are safeguards like DKIM, DMARC, and SPF to prevent spoofing of well-known domains, threat actors are now leveraging old, neglected domains to evade security checks based on domain age.
In a recent analysis, a DNS threat intelligence firm found that threat actors, including groups like Muddling Meerkat, are using old, disused top-level domains that lack essential DNS records to authenticate sender domains. These domains, which have not been used for hosting content in nearly 20 years, are being exploited in malspam campaigns, such as those distributing email messages with phishing attachments containing QR codes.
One such campaign, active since December 2022, targets recipients with tax-related lures in Mandarin, instructing them to scan QR codes using AliPay or WeChat apps. The emails lock the QR code documents behind a password and lead victims to phishing sites where they are prompted to enter sensitive information. Additionally, phishing campaigns impersonating popular brands like Amazon and Mastercard have been observed, redirecting victims to fake login pages to steal credentials.
Furthermore, a category of spam involves extortion, where recipients are asked to make Bitcoin payments to delete embarrassing videos purportedly recorded using remote access trojan software. Another phishing campaign targeting legal, government, and construction sectors, called Butcher Shop, aims to steal Microsoft 365 credentials using trusted platforms like Canva and Dropbox. These attacks highlight the growing threat of cybercrime facilitated by neglected domains and sophisticated social engineering schemes.
The prevalence of cybercrime domains using generic top-level domains like .top, .xyz, and .club has raised concerns, as these domains accounted for 37% of reported cybercrime domains despite representing only 11% of the total domain name market. The accessibility and affordability of these domains make them attractive to malicious actors, underscoring the need for enhanced cybersecurity measures to combat evolving threats in the digital landscape. Cybercriminals are taking advantage of the accessibility and affordability of certain generic top-level domains (gTLDs) to carry out malicious activities. A recent study revealed that 22 gTLDs offer registration fees of less than $2.00, making it easier for threat actors to register domains for fraudulent purposes.
One concerning discovery is the existence of a malicious WordPress plugin known as PhishWP, which enables cybercriminals to create fake payment pages resembling legitimate payment processors like Stripe. By using this plugin, attackers can trick unsuspecting users into entering their personal and financial information, which is then captured and sent directly to the criminals via Telegram.
According to a report by SlashNext, attackers can compromise legitimate WordPress websites or create fraudulent ones to install the PhishWP plugin. Once configured to mimic a payment gateway, the plugin lures users into providing their payment details, which are then harvested by the cybercriminals in real-time.
The ease of setting up phishing traps using tools like PhishWP highlights the evolving tactics of cybercriminals and the importance of staying vigilant online. It is crucial for internet users to be cautious when entering sensitive information on websites and to ensure that they are using secure and legitimate payment platforms to protect themselves from falling victim to such scams.
To stay informed about the latest cybersecurity threats and trends, follow reputable sources like The Hacker News on Twitter and LinkedIn for exclusive content and updates. By staying informed and educated, individuals and organizations can better protect themselves from cyber threats and safeguard their sensitive information online.
Source link
