LPF Hints, Tips and Information

Posts Tagged ‘Credentials’

Despite the consistent media exposure that FAKEAV malware receives, it has always been business-as-usual for the FAKEAV proponents. To find out why the notorious malware persists, Trend Micro researchers looked into three important aspects.

These include: 1) social engineering techniques; 2) FAKEAV technology; and 3) the FAKEAV business itself.

Social Engineering

Social engineering is a technique prevalently used in furthering malicious activities both online and offline. Online, however, FAKEAV is a good example of a social engineering success story. By leveraging human weakness, FAKEAV effectively utilizes social engineering techniques such as “Black Hat” search engine optimization (SEO) to trick users.

The Technology Behind FAKEAV

Behind the professional looking GUIs, annoying pop-ups and other scareware tactics used by FAKEAV lies a simple technology. It can thus be said that FAKEAV technology is more tricky than complex. Despite the relative simplicity of FAKEAV technology, however, it plays a critical role in the success of FAKEAV’s social engineering tactics.

The FAKEAV Business

Of course, a malicious campaign is meaningless if it does not benefit its proponents. When it comes to the FAKEAV business, the stakes are high. Apart from taking away about US$ 40–100 from a user’s account as payment for rogue software, the more pressing concern with FAKEAV is information theft.

Learn more about the persistent FAKEAV and its three fundamental aspects with Security Spotlight article, “Why FAKEAV Persists” [.pdf].

Post from: TrendLabs | Malware Blog - by Trend Micro

The Persistence of FAKEAV

TrendLabs^SM recently encountered a phishing email specifically targeting Standard Chartered Bank clients. The spammed message instructs recipients to log in to their online accounts and to visit the Secure Messages section to read a specific message. The email body includes an embedded link, which when clicked leads to a phishing page.

The use of bogus login pages has become a typical attack vector that phishers continue to use. Similar phishing attacks via spammed messages have been documented here in the Malware Blog:

• Phishing Pages Pose as Secure Login Pages
• Caisse d’Epargne Customers, Beware!
• Citi Prepaid Phishing Services

While this is an old trick, clients who visit the page may still unwittingly provide their bank credentials to cybercriminals’ waiting hands. Users are then advised to constantly exercise caution when opening email messages and when clicking embedded links. Standard Chartered Bank likewise reminds its clients to be wary of the reality of online threats, including phishing attacks.

Trend Micro™ Smart Protection Network™ already protects product users from this particular threat by preventing the spammed message from even reaching their inboxes via the email reputation service and by blocking access to the phishing site via the Web reputation service.

Non-Trend Micro product users can also stay protected from malicious URLs by using one of free tools like Web Protection Add-On, a lightweight add-on solution designed to proactively protect computers against Web threats.

Post from: TrendLabs | Malware Blog - by Trend Micro

Phishers Send Out Standard Chartered Spam

Cyber criminals are offering an online service that claims to be able to hack any Facebook account for $100. The site, uncovered by IT security vendor Panda Security, allegedly provides clients with the login and password credentials to access accounts of ordinary people, as well as celebrities, politicians and well-known companies.
Read the rest of this entry »