Skip to main content

This phishing scam lures you in by pretending you've got a bonus

Cartoon Phishing
(Image credit: Shutterstock / DRogatnev)

Security researchers at Fortinet have discovered a new phishing campaign which tries to lure enterprise users with fake customer complaint reports, fake billing statements and even the offer of a phony bonus.

The campaign also uses a new variant of the Bazar trojan, which has been linked to the developers of Trickbot, that comes equipped with anti-analysis techniques to make it more difficult for antivirus software to detect.

These anti-analysis techniques include hiding malicious APIs in the code, extra code obfuscation and encrypting some strings of the code to make the trojan more difficult to analyze.

Bazar is a relatively new trojan which first appeared last year. If successfully deployed, it can provide cybercriminals with a backdoor into a compromised Windows system to allow them to control a user’s device, gain additional access to a corporate network to steal sensitive data and deploy malware.

Bazar trojan

Regardless of the theme used, this new phishing campaign tries to encourage a potential victim to click on a link that redirects them to a malicious website with a downloadable PDF

However, while the page prominently features the PDF logo, it doesn’t actually contain a document. Instead there are three links that all point to the same executable which when downloaded, installs the Bazar trojan on a user’s system. Once installation is complete, a backdoor is present on a victim’s system that an attacker can exploit on their own or sell to other cybercriminals on dark web marketplaces.

According to Fortinet, this phishing campaign remains active and attempted attacks are still being observed in the wild.

To prevent falling victim to this or other similar attacks, the firm’s researchers recommend that organizations provide training for their employees on how to identify and recognize online scams and attacks. At the same time though, organizations should also implement a patch management strategy to prevent cybercriminals from exploiting known vulnerabilities.

Via ZDNet

Anthony Spadafora

After living and working in South Korea for seven years, Anthony now resides in Houston, Texas where he writes about a variety of technology topics for ITProPortal and TechRadar. He has been a tech enthusiast for as long as he can remember and has spent countless hours researching and tinkering with PCs, mobile phones and game consoles.