Kaspersky Lab experts detected a blast of sophisticated spam emails in the first quarter of 2019, featuring fake job-offers that seemed to come from HR-recruiters in large corporations that traditionally attract a lot of interest from potential employees. However, the emails actually came from spammers and installed money -stealing malware on users’ devices.
Spam emails are an often underestimated threat, yet they can spread malware through social engineering methods like deception and psychological manipulation, and claim many victims. To track such emails, Kaspersky Lab researchers use honeypots – virtual ‘traps’ able to detect malicious emails and catch threat actors. For this particular operation, they tracked fraudsters trying to exploit unwary people looking for a new role.
Analysis of the findings from the honeypots is included in the new Spam and Phishing in Q1 2019 report. This shows that recipients of the spam emails were offered a tempting position in a large company. They were invited to join a job search system for free by installing a special application on their device that would provide access to the job-search database. To make the installation process look trustworthy, the attackers accompanied it with a pop-up window carrying the words “DDoS Protection” and a fake message that claimed the user was being redirected to the website of one of the largest recruitment agencies.
In fact, victims were redirected to a cloud storage site from where they would download a malicious installer that looked like a word file. Its function was to download to the victim’s machine the infamous Gozi banking trojan, one of the most commonly used malware for stealing money. Kaspersky Lab detects it as Trojan-Banker.Win32.Gozi.bqr
“We often see spammers using names of large and well-known companies – it helps them to succeed in their malicious business and gain people’s trust. Famous brands with a solid reputation can become victims of fraudsters who pretend to be them and lure unsuspecting users into downloading a malicious attachment to their computers. This particular scheme involved the names of both well known recruiting companies and respected businesses, which made it even more sophisticated. One needed to check the email address line for errors to suspect that the job offer was not authentic,” said Maria Vergelis, a security researcher at Kaspersky Lab.
