Attackers Hijack Craigslist Emails to Bypass Security, Deliver Malware

guest · Oct 26, 2021

Attackers Hijack Craigslist Emails to Bypass Security, Deliver Malware
October 26, 2021
https://threatpost.com/attackers-hijack-craigslist-email-malware/175754/

Musical instruments, motorcycle parts and now malware — Craigslist really does have it all.

The Craigslist internal email system was hijacked by attackers this month to deliver convincing messages messages, ultimately aimed avoiding Microsoft Office security controls to deliver malware.
Click to expand...

Sent from an authentic Craigslist IP address, the emails informed users that a published ad of theirs included inappropriate content and violated Craigslist‘s terms and conditions, giving false instructions on how to avoid having their accounts deleted.

Researchers at INKY discovered that the attackers manipulated the email’s HTML into a customized document with a malware-download link uploaded to a Microsoft OneDrive page. That page impersonated major brands like DocuSign, Norton and Microsoft.

“Since the URL to resolve the issue hosted a customized document placed on Microsoft OneDrive, it did not appear on any threat intelligence feed, allowing it to slip past most security vendors,” the researchers noted in a posting this week.
Click to expand...

“It appears as if bad actors were able to manipulate the email’s HTML to create that button and link it to OneDrive,” the researchers wrote. “Hovering over the link revealed a Russian domain (myjino[.]ru).”

Clicking on the link initiated a .ZIP file download containing a macro-enabled spreadsheet that delivered malware. To get around Microsoft Office security controls and run the macros, the malicious documents prompted victims to click on a button to “Enable Editing” or “Enable Content,” INKY said.
Click to expand...

Nonetheless, the INKY team said this Craigslist-hosted attack could have been used to install a remote access tool (RAT), launch a ransomware attack, implement a first-stage implant like TrickBot, exfiltrate sensitive data or deploy a keylogger.
Click to expand...

Log in or Sign up

Attackers Hijack Craigslist Emails to Bypass Security, Deliver Malware

guest Guest

Log in or Sign up

Attackers Hijack Craigslist Emails to Bypass Security, Deliver Malware

guest Guest

Useful Searches