Beware of fake "Gmail suspicious login" warnings
Posted on 15.08.2014
Malicious emails impersonating Gmail Account Services have been spotted hitting inboxes around the world, falsely claiming that the users' Gmail account has been logged into from an unrecognized device.

"Even though the email message is similar to a legitimate Gmail message, a careful user will note that the displayed e-mail address and the supposed source address did not match. Further examination of the email’s headers indicates that the email was, in fact, sent via a website’s mail form," pointed out Trend Micro techie Jay Yaneza.

Also, all the links in the email ("Change your password", "Update your account password reset info", "Help Center"), as well as the "Check Your Account" button, lead to a HTML file hosted on Google Drive.

The file is not malicious in itself, it only detects what OS and browser the visitor uses. This allows them to be redirected to a specific website claiming that one of their plugins must be updated (here is an example for Firefox):


But while the HTML code can differentiate between different OSes and browsers, currently only Windows users are danger, as the fake updates pushed on them are backdoor trojans targeting that particular platform.

The malware steals usernames and passwords, acts like a keylogger, and can accept remote commands from the attackers.

According to Yaneza, the malware is also hosted in Google Drive, and the payloads are frequently changed.

"As these files are located on legitimate services, they are also sent via HTTPS, which helps evade some web filtering techniques," he pointed out, and added that the fact that the spam emails are sent via a compromised website’s mailer system and an IPv6 address, email reputation services might also have a hard time spotting and blocking them.









Spotlight

How to keep your contactless payments secure

Posted on 19 September 2014.  |  Fraudsters can pickpocket a victim’s financial data using low-cost electronics that can fit into a rucksack. Here are the top security threats you should be aware of if you’re using a RF-based card, along with our top safety tips to keep your payments secure.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Mon, Sep 22nd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //