News

Fake Microsoft Service Agreement E-mails Mails Used in Java Exploit

A recent phishing campaign that employs a Microsoft e-mail template has been spotted in the wild by researchers.

Security firm Internet Storm Center disclosed the scam over the weekend. According to Russ McRee, a researcher with the group, the fake e-mail campaign mimics Microsoft's "Important Changes to Microsoft Services Agreement and Communication Preferences" in attempts to exploit the Java flaw that was publically demonstrated last week.

McRee wrote in a recent company blog entry that instead of linking to a legitimate Microsoft site, the "phishing mail will instead include a hyperlink to the likes of allseasons****.us, radiothat****.com, and likely a plethora of others."

These redirects lead to Web sites hosting the Blackhole exploit toolkit, which has been recently updated to include the Java exploit. And, with the nature of the toolkit, a user would only need to visit the malicious Web site to have the malware downloaded and installed -- no user action is needed.

A Microsoft product manager that goes by the user name "Karla L" provided in a Microsoft forum  some tips on how to check if an e-mail was actually sent by the company:

"If you received an email regarding the Microsoft Services Agreement update and you're reading your email through the Hotmail or Outlook.com web UI, the legitimate email should have a Green shield that indicates the message is from a Trusted Sender. If the email does not have a Green shield, you can mark the email as a Phishing scam.  Do not click through the links in the email if you are not sure it is safe."

A handful of security software firms have also added the malicious e-mail into its database. Symantec Endpoint Protection has labeled this phishing scam as "Trojan.Maljava!Gen23."

Oracle released an update last week for the zero-day flaw that can allow attackers to modify the level of privileges on a targeted machine. However, according to an earlier survey conducted by security firm Rapid7, only 38 percent of Java users update to the latest version six months after release. That means the vast majority of the Web-based plugin users are currently at risk.

To update to the latest version of Java (version 7, update 7), click here.

 

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

Featured

  • Gears

    Top 10 Microsoft Tips and Analyses of 2018

    Here are the year's most popular explainers and how-to columns -- along with some plain, old "Why did Microsoft do that?" musings thrown in.

  • Sign

    2018 Microsoft Predictions Revisited

    From guessing the fate of Windows 10 S to predicting Microsoft's next big move with Linux, Brien's predictions from a year ago were on the mark more than they weren't.

  • Microsoft Recaps Delivery Optimization Bandwidth Controls for Organizations

    Microsoft expects organizations using its Delivery Optimization peer-to-peer update scheme will optimally see 60 percent to 70 percent improvements in terms of network bandwidth use.

  • Getting a Handle on Hyper-V Virtual NICs

    Hyper-V usually makes it easy to configure virtual network adapters within VMs. That is, until you need to create a VM containing multiple virtual NICs.

comments powered by Disqus
Most   Popular

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.