News

Fake Microsoft Service Agreement E-mails Mails Used in Java Exploit

A recent phishing campaign that employs a Microsoft e-mail template has been spotted in the wild by researchers.

Security firm Internet Storm Center disclosed the scam over the weekend. According to Russ McRee, a researcher with the group, the fake e-mail campaign mimics Microsoft's "Important Changes to Microsoft Services Agreement and Communication Preferences" in attempts to exploit the Java flaw that was publically demonstrated last week.

McRee wrote in a recent company blog entry that instead of linking to a legitimate Microsoft site, the "phishing mail will instead include a hyperlink to the likes of allseasons****.us, radiothat****.com, and likely a plethora of others."

These redirects lead to Web sites hosting the Blackhole exploit toolkit, which has been recently updated to include the Java exploit. And, with the nature of the toolkit, a user would only need to visit the malicious Web site to have the malware downloaded and installed -- no user action is needed.

A Microsoft product manager that goes by the user name "Karla L" provided in a Microsoft forum  some tips on how to check if an e-mail was actually sent by the company:

"If you received an email regarding the Microsoft Services Agreement update and you're reading your email through the Hotmail or Outlook.com web UI, the legitimate email should have a Green shield that indicates the message is from a Trusted Sender. If the email does not have a Green shield, you can mark the email as a Phishing scam.  Do not click through the links in the email if you are not sure it is safe."

A handful of security software firms have also added the malicious e-mail into its database. Symantec Endpoint Protection has labeled this phishing scam as "Trojan.Maljava!Gen23."

Oracle released an update last week for the zero-day flaw that can allow attackers to modify the level of privileges on a targeted machine. However, according to an earlier survey conducted by security firm Rapid7, only 38 percent of Java users update to the latest version six months after release. That means the vast majority of the Web-based plugin users are currently at risk.

To update to the latest version of Java (version 7, update 7), click here.

 

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

Featured

  • Malwarebytes Affirms Other APT Attack Methods Used Besides 'Solorigate'

    Security solutions company Malwarebytes affirmed on Monday that alternative methods besides tainted SolarWinds Orion software were used in the recent "Solorigate" advanced persistent threat (APT) attacks.

  • How To Fix the Hyper-V Read Only Disk Problem

    DOS might seem like a relic now, but sometimes it's the only way to fix a problem that Windows seems ill-equipped to deal with -- like this one.

  • Microsoft Warns IT Pros on Windows Netlogon Fix Coming Next Month

    Microsoft on Thursday issued a reminder to organizations to ensure that their systems are properly patched for a "Critical"-rated Windows Netlogon vulnerability before next month's "update Tuesday" patch distribution arrives.

  • Microsoft Nudging Skype for Business Users to Teams

    Microsoft on Thursday announced some perks and prods for Skype for Business unified communications users, with the aim of moving them to the Microsoft Teams collaboration service instead.

comments powered by Disqus