CNN Gaza Spam Scam: Headlines Make Phishing LinesCNN Gaza Spam Scam: Headlines Make Phishing Lines
Spam phishers are at it again, trying to turn headlines and media sources into phish bait. This time it was the Gaza crisis, with supposedly legitimate CNN mail guiding the gullible to Trojan-bearing malware sites.
January 9, 2009
Spam phishers are at it again, trying to turn headlines and media sources into phish bait. This time it was the Gaza crisis, with supposedly legitimate CNN mail guiding the gullible to Trojan-bearing malware sites.The latest round of urgent news update phishing scams -- reported by scurity firm RSA as e-mail guides to a Web site promising exclusive CNN reports and images from Gaza -- isn't likely to become as pervasive or widespread as last year's election-oriented spam campaign but should nonetheless raise some alarms -- and give you the chance to pass those alarms along to your employees and co-workers.
It's an important reminder, only slightly less so now that RSA has reported taking down the attack, which was launched from a Chinese domain.
Make these a part of your security/usage policy if they aren't already there. If you don't have a written, enforceable security/usage policy, get one, and then make these a part of it.
Here's how this one works (or tried to):
The bogus CNN/Gaza attack starts with a e-mail containing links that guide the unwary to a site that looks most CNN-ish... until (or unless)
Visitors are prompted to download an Adobe Acrobat update. What they get is a Trojan, one that immediately starts sniffing for SSL information -- secure site visit information that gives the crooks a map of your financial and secure transactional paths.
Simple enough -- and simple enough to fall for if you, and everybody in your business isn't on-guard all the time.
If you haven't had your regular -- monthly, at least -- reminder session with everyone in your company who uses a computer, now's the time to walk them through the basics:
1. Don't read unsolicited e-mail (I'd say don't read any non-business e-mail at work, but we all know how likely that is.)
About the Author(s)
You May Also Like
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
What's In Your Cloud?Nov 30, 2023
Everything You Need to Know About DNS AttacksNov 30, 2023
Passwords Are Passe: Next Gen Authentication Addresses Today's Threats
How to Deploy Zero Trust for Remote Workforce Security
Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware
Everything You Need to Know About DNS Attacks
Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks