News
Fake Microsoft Service Agreement E-mails Mails Used in Java Exploit
A recent phishing campaign that employs a Microsoft e-mail template has been spotted in the wild by researchers.
Security firm Internet Storm Center disclosed the scam over the weekend. According to Russ McRee, a researcher with the group, the fake e-mail campaign mimics Microsoft's "Important Changes to Microsoft Services Agreement and Communication Preferences" in attempts to exploit the Java flaw that was publically demonstrated last week.
McRee wrote in a recent company blog entry that instead of linking to a legitimate Microsoft site, the "phishing mail will instead include a hyperlink to the likes of allseasons****.us, radiothat****.com, and likely a plethora of others."
These redirects lead to Web sites hosting the Blackhole exploit toolkit, which has been recently updated to include the Java exploit. And, with the nature of the toolkit, a user would only need to visit the malicious Web site to have the malware downloaded and installed -- no user action is needed.
A Microsoft product manager that goes by the user name "Karla L" provided in a Microsoft forum some tips on how to check if an e-mail was actually sent by the company:
"If you received an email regarding the Microsoft Services Agreement update and you're reading your email through the Hotmail or Outlook.com web UI, the legitimate email should have a Green shield that indicates the message is from a Trusted Sender. If the email does not have a Green shield, you can mark the email as a Phishing scam. Do not click through the links in the email if you are not sure it is safe."
A handful of security software firms have also added the malicious e-mail into its database. Symantec Endpoint Protection has labeled this phishing scam as "Trojan.Maljava!Gen23."
Oracle released an update last week for the zero-day flaw that can allow attackers to modify the level of privileges on a targeted machine. However, according to an earlier survey conducted by security firm Rapid7, only 38 percent of Java users update to the latest version six months after release. That means the vast majority of the Web-based plugin users are currently at risk.
To update to the latest version of Java (version 7, update 7), click here.