News

Fake Microsoft Service Agreement E-mails Mails Used in Java Exploit

A recent phishing campaign that employs a Microsoft e-mail template has been spotted in the wild by researchers.

Security firm Internet Storm Center disclosed the scam over the weekend. According to Russ McRee, a researcher with the group, the fake e-mail campaign mimics Microsoft's "Important Changes to Microsoft Services Agreement and Communication Preferences" in attempts to exploit the Java flaw that was publically demonstrated last week.

McRee wrote in a recent company blog entry that instead of linking to a legitimate Microsoft site, the "phishing mail will instead include a hyperlink to the likes of allseasons****.us, radiothat****.com, and likely a plethora of others."

These redirects lead to Web sites hosting the Blackhole exploit toolkit, which has been recently updated to include the Java exploit. And, with the nature of the toolkit, a user would only need to visit the malicious Web site to have the malware downloaded and installed -- no user action is needed.

A Microsoft product manager that goes by the user name "Karla L" provided in a Microsoft forum  some tips on how to check if an e-mail was actually sent by the company:

"If you received an email regarding the Microsoft Services Agreement update and you're reading your email through the Hotmail or Outlook.com web UI, the legitimate email should have a Green shield that indicates the message is from a Trusted Sender. If the email does not have a Green shield, you can mark the email as a Phishing scam.  Do not click through the links in the email if you are not sure it is safe."

A handful of security software firms have also added the malicious e-mail into its database. Symantec Endpoint Protection has labeled this phishing scam as "Trojan.Maljava!Gen23."

Oracle released an update last week for the zero-day flaw that can allow attackers to modify the level of privileges on a targeted machine. However, according to an earlier survey conducted by security firm Rapid7, only 38 percent of Java users update to the latest version six months after release. That means the vast majority of the Web-based plugin users are currently at risk.

To update to the latest version of Java (version 7, update 7), click here.

 

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

Featured

  • Basic Authentication Extended to 2H 2021 for Exchange Online Users

    Microsoft is now planning to disable Basic Authentication use with its Exchange Online service sometime in the "second half of 2021," according to a Friday announcement.

  • Microsoft Offers Endpoint Configuration Manager Advice for Keeping Remote Clients Patched

    Microsoft this week offered advice for organizations using Microsoft Endpoint Configuration Manager with remote Windows systems that need to get patched, and it also announced Update 2002.

  • Azure Edge Zones Hit Preview

    Azure Edge Zones, a new edge computing technology from Microsoft designed to enable new scenarios for developers and partners, emerged as a preview release this week.

  • Microsoft Shifts 2020 Events To Be Online Only

    Microsoft is shifting its big events this year to be online only, including Ignite 2020.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.