PC Security and Other Useful Information

Phish of GoDaddy Employee Jeopardized Escrow.com, Among Others

“A spear-phishing attack this week hooked a customer service employee at GoDaddy.com, the world’s largest domain name registrar, KrebsOnSecurity has learned. The incident gave the phisher the ability to view and modify key customer records, access that was used to change domain settings for a half-dozen GoDaddy customers, including transaction brokering site escrow.com.”

Tricky Phish Angles for Persistence, Not Passwords

“Late last year saw the re-emergence of a nasty phishing tactic that allows the attacker to gain full access to a user’s data stored in the cloud without actually stealing the account password. The phishing lure starts with a link that leads to the real login page for a cloud email and/or file storage service. Anyone who takes the bait will inadvertently forward a digital token to the attackers that gives them indefinite access to the victim’s email, files and contacts — even after the victim has changed their password.”

7M Adobe Creative Cloud Users Exposed to Hackers

“An open cloud database sets the stage for phishing attacks for users of the subscription service.”

Phishing Emails Pretend to be Office 365 ‘File Deletion’ Alerts

‘A new phishing campaign is underway that pretends to be from the “Office 365 Team” warning recipients that there has been unusual amount of file deletions occurring on their account.’

Microsoft Sees 250% Phishing Increase, Malware Decline by 34%

“Phishing attacks have seen an impressive 250% increase between January and December 2018, with attackers moving to multiple points of attacks during the same campaign, switching between URLs, domains, and servers when sending e-mails and hosting phishing forms.”

New Extortion Email Threatens to Send a Hitman Unless You Pay 4K

“Extortion emails are getting wilder and wilder. First we had sextortion scams that threatened to reveal victims doing dirty deeds on video, then bomb threats, which brought the worlwide attention of law enforcement, and now we have threats that a hitman is targeting the recipient unless they pay $4,000 in bitcoin.”

Phishing Attack Pretends to be a Office 365 Non-Delivery Email

“A phishing campaign has been discovered that pretends to be a non-delivery notifications from Office 365 that leads you to a page attempting to steal your login credentails.

This new campaign was discovered by ISC Handler Xavier Mertens and states that “Microsoft found Several Undelivered Messages”. It then prompts you to click on the “Send Again” link in order to try sending the emails again. “

PayPal phishing scam using Conditional CSS tricks and Google Captcha

Thanks to Mark Pahulje, MVP  for pointing this out.

Apple Phishing Email – Deezer Music & Podcast Player by DEEZER, Subscription renewal

“Notice of Apple Phishing Email – “Deezer Music & Podcast Player by DEEZER, Subscription renewal” made it through Outlook filters. The JavaScript malware contained in the PDFs, passed VirusTotal and many anti-virus scans online without detection. “