Beware of fake "Gmail suspicious login" warnings
Posted on 15.08.2014
Malicious emails impersonating Gmail Account Services have been spotted hitting inboxes around the world, falsely claiming that the users' Gmail account has been logged into from an unrecognized device.

"Even though the email message is similar to a legitimate Gmail message, a careful user will note that the displayed e-mail address and the supposed source address did not match. Further examination of the email’s headers indicates that the email was, in fact, sent via a website’s mail form," pointed out Trend Micro techie Jay Yaneza.

Also, all the links in the email ("Change your password", "Update your account password reset info", "Help Center"), as well as the "Check Your Account" button, lead to a HTML file hosted on Google Drive.

The file is not malicious in itself, it only detects what OS and browser the visitor uses. This allows them to be redirected to a specific website claiming that one of their plugins must be updated (here is an example for Firefox):

But while the HTML code can differentiate between different OSes and browsers, currently only Windows users are danger, as the fake updates pushed on them are backdoor trojans targeting that particular platform.

The malware steals usernames and passwords, acts like a keylogger, and can accept remote commands from the attackers.

According to Yaneza, the malware is also hosted in Google Drive, and the payloads are frequently changed.

"As these files are located on legitimate services, they are also sent via HTTPS, which helps evade some web filtering techniques," he pointed out, and added that the fact that the spam emails are sent via a compromised website’s mailer system and an IPv6 address, email reputation services might also have a hard time spotting and blocking them.


New Zeus variant targets users of 150 banks

Posted on 19 December 2014.  |  A new variant of the infamous Zeus banking and information-stealing Trojan has been created to target the users of over 150 different banks and 20 payment systems in 15 countries, including the UK, the US, Russia, Spain and Japan.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Mon, Dec 22nd