Spam phishers are at it again, trying to turn headlines and media sources into phish bait. This time it was the Gaza crisis, with supposedly legitimate CNN mail guiding the gullible to Trojan-bearing malware sites.
Spam phishers are at it again, trying to turn headlines and media sources into phish bait. This time it was the Gaza crisis, with supposedly legitimate CNN mail guiding the gullible to Trojan-bearing malware sites.The latest round of urgent news update phishing scams -- reported by scurity firm RSA as e-mail guides to a Web site promising exclusive CNN reports and images from Gaza -- isn't likely to become as pervasive or widespread as last year's election-oriented spam campaign but should nonetheless raise some alarms -- and give you the chance to pass those alarms along to your employees and co-workers.
It's an important reminder, only slightly less so now that RSA has reported taking down the attack, which was launched from a Chinese domain.
Make these a part of your security/usage policy if they aren't already there. If you don't have a written, enforceable security/usage policy, get one, and then make these a part of it.
Here's how this one works (or tried to):
The bogus CNN/Gaza attack starts with a e-mail containing links that guide the unwary to a site that looks most CNN-ish... until (or unless)
Visitors are prompted to download an Adobe Acrobat update. What they get is a Trojan, one that immediately starts sniffing for SSL information -- secure site visit information that gives the crooks a map of your financial and secure transactional paths.
Simple enough -- and simple enough to fall for if you, and everybody in your business isn't on-guard all the time.
If you haven't had your regular -- monthly, at least -- reminder session with everyone in your company who uses a computer, now's the time to walk them through the basics:
1. Don't read unsolicited e-mail (I'd say don't read any non-business e-mail at work, but we all know how likely that is.)
About the Author(s)
You May Also Like
Guarding the Cloud: Top 5 Cloud Security Hacks and How You Can Avoid Them
April 4, 2024Cybersecurity Strategies for Small and Med Sized Businesses
April 11, 2024Defending Against Today's Threat Landscape with MDR
April 18, 2024Securing Code in the Age of AI
April 24, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024Black Hat Asia - April 16-19 - Learn More
April 16, 2024