Hackers have found a way to send spam emails that appear to hvae originated from trusted organizations, including some of the world's biggest brands, in a new campaign that has been described as “massive”.
The messages themselves are what you’d usually expect from a phishing email: a series of redirections generating revenue via fraudulent ads, fake giveaways, affiliate scams, and similar, according to Guardio Labs, which believes the campaign has been active since at least 2022.
Some of the companies abused in this campaign include MSN, VMware, McAfee, The Economist, Cornell University, CBS, NYC.gov, PWC, Pearson, Better Business Bureau, Unicef, ACLU, Symantec, Java.net, Marvel, and eBay.
Major campaign
Every day of the campaign, some five million emails were being sent. The researchers can’t determine exactly how much money was made through the campaign, but claim that it’s undoubtedly a lot.
In total, more than 8,000 legitimate internet domains, as well as 13,000 subdomains have been abused in the campaign, which was later dubbed “SubdoMailing”.
Guardio Labs recently analyzed one such email that seemed to have come from MSN, sent by a threat actor known as ResurrecAds.
The threat actor scanned the internet for subdomains of reputable brands with CNAME records pointing to expired external domains, and once found, registered them via NameCheap.
Once registered with NameCheap, the hackers “hijack” the domain and send spam and phishing emails. They have also hosted phishing pages and deceptive advertising which, on the victim’s side, would seem as if a reputable, trusted brand was sending the email.
The hackers have also been scanning the internet for SPF records of target domains using the “include:” configuration option that pointed to defunct external domains, for the same results. With “include:”, the attackers were able to import allowed email senders from the external domain. Consequently, all of the emails would pass through security checks and land straight into people’s inboxes.
Via BleepingComputer
More from TechRadar Pro
- Best ransomware protection of 2024
- Here's a list of the best firewalls around today
- These are the best endpoint security tools right now
