Beware of fake "Gmail suspicious login" warnings
Posted on 15.08.2014
Malicious emails impersonating Gmail Account Services have been spotted hitting inboxes around the world, falsely claiming that the users' Gmail account has been logged into from an unrecognized device.

"Even though the email message is similar to a legitimate Gmail message, a careful user will note that the displayed e-mail address and the supposed source address did not match. Further examination of the email’s headers indicates that the email was, in fact, sent via a website’s mail form," pointed out Trend Micro techie Jay Yaneza.

Also, all the links in the email ("Change your password", "Update your account password reset info", "Help Center"), as well as the "Check Your Account" button, lead to a HTML file hosted on Google Drive.

The file is not malicious in itself, it only detects what OS and browser the visitor uses. This allows them to be redirected to a specific website claiming that one of their plugins must be updated (here is an example for Firefox):


But while the HTML code can differentiate between different OSes and browsers, currently only Windows users are danger, as the fake updates pushed on them are backdoor trojans targeting that particular platform.

The malware steals usernames and passwords, acts like a keylogger, and can accept remote commands from the attackers.

According to Yaneza, the malware is also hosted in Google Drive, and the payloads are frequently changed.

"As these files are located on legitimate services, they are also sent via HTTPS, which helps evade some web filtering techniques," he pointed out, and added that the fact that the spam emails are sent via a compromised website’s mailer system and an IPv6 address, email reputation services might also have a hard time spotting and blocking them.









Spotlight

Staples customers likely the latest victims of credit card breach

Posted on 21 October 2014.  |  Multiple banks say they have identified a pattern of credit and debit card fraud suggesting that several Staples Inc. office supply locations in the Northeastern United States are currently dealing with a data breach.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Wed, Oct 22nd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //