News: Cexx forums, with volunteers dedicated to helping you remove malware and stay protected
 
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
September 02, 2014, 01:09:45
Pages: 1 ... 30 31 [32] 33 34 ... 83   Go Down
  Print  
Topic: SPAM frauds, fakes, and other MALWARE deliveries...  (Read 273669 times)
0 Members and 12 Guests are viewing this topic.
« Reply #465 on: June 30, 2011, 02:37:59 »
AplusWebMaster Offline
Global Moderator WWW

Karma: 501
Posts: 8233



FYI...

SPAM to avoid...
- http://sunbeltblog.blogspot.com/2011/06/some-spam-to-avoid.html
June 29, 2011 - "...
1) "Facebook Survey Gift Invite"...
2) Paypal phish...
3) World of Warcraft phish mails..."

Social network SPAM growth...
- http://www.symantec.com/connect/blogs/social-network-attacks-surge
June 29, 2011 - "... Spam attacks via social networks grew dramatically between April and June 2011. Over this period, we monitored and analyzed social network spam attacks that used three popular social networking sites — Facebook, Twitter, and YouTube... Most of the spam originates from botnets... Most of these IP addresses were blacklisted by reputation-based technology because of their spam involvement. Along with bot activity, some spam samples are seen to be sent through hijacked user accounts and fake social network accounts created by the spammers... Social network spam uses legitimate email notification templates from the social networking sites. The message alleges that the user has some unread messages or pending invites and a fake link is provided. The bogus link will direct users to a website that forces the download of malicious binaries, purports to be selling cheap enhancement drugs and replica products, pushes fake gambling casino sites, or advertises online adult dating sites, etc... The most common subject lines used in this case are as follows:
Subject: Hi, you have notifications pending
Subject: Oops.. You have notifications pending
Subject: Hi, You have 1 new direct message
Subject: You have 2 direct message on Twitter!
Subject: YouTube Administration sent you a message: Your video has been approved
Subject: YouTube Administration sent you a message: Your video on the TOP of YouTube
Subject: Direct message from [removed]
Subject: Warning: Your inbox is full, message not accepted
Subject: [removed] sent you a message on Facebook...
"
(Screenshots available at the Symantec URL above.)
___

SPAM volume - charted July 2010 - June 2011
- http://krebsonsecurity.com/wp-content/uploads/2011/07/symspam11.jpg

 Evil or Very Mad
« Last Edit: July 01, 2011, 13:41:09 by AplusWebMaster » Logged

This machine has no brain.
....... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.
« Reply #466 on: July 01, 2011, 03:42:33 »
AplusWebMaster Offline
Global Moderator WWW

Karma: 501
Posts: 8233



FYI...

Hiloti trojan downloader infection rates triple in UK
- http://www.trusteer.com/blog/hiloti-trojan-downloader-infection-rates-triple-uk
June 30, 2011 - "Hiloti generic downloader is a trojan first seen in December 2008 has shown a dramatic increase in infection rates of PCs during June 2011. Hiloti is a generic malware downloader, meaning it typically downloads other malware, e.g. Zeus and SpyEye. Hiloti creates a malicious DLL in the Windows directory, and hacks the Windows registry to maintain its presence on an infected machine across a normal boot cycle. We suspect that a Hiloti-infecting campaign - which is quite likely to be a drive-by download infection - is now taking place, having started on June 20th... the Hiloti malware is surging to two to three times it previously level of infections*... the infection does not appear to be affecting the US and other international territories, suggesting that it is a carefully targeted attack on one of more UK banking portals..." 
* http://www.trusteer.com/sites/default/files/hiloti.jpg

 Sad Evil or Very Mad
Logged

This machine has no brain.
....... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.
« Reply #467 on: July 02, 2011, 12:57:49 »
AplusWebMaster Offline
Global Moderator WWW

Karma: 501
Posts: 8233



FYI...

Google+ SPAM campaign...
- http://sunbeltblog.blogspot.com/2011/07/spammers-hone-in-on-google.html
July 02, 2011 - "... Sophos has found what we consider as, probably, the first crime ever targeting Google+: fake pharma spam... spammers didn't take long before they push a campaign to take advantage of Internet users badly wanting to be put in circles. It's the current "it" thing, after all. Not to mention the current perfect target of any threat attack, and spamming was the first..."
* http://nakedsecurity.sophos.com/2011/07/01/google-plus-spam/
"... clicking on the links will not take you to the new social network, but instead take you to a pharmacy website set up to sell the likes of Viagra, Cialis and Levitra to the unwary..."
(Screenshots available at the Sophos URL above.)
___

- https://plus.google.com/107117483540235115863/posts/PhJFJqLyRnm
Jun 29, 2011 - "We've shut down invite mechanism for the night. Insane demand... For any who wish to leave, please remember you can always exit and take your data with you by using Google Takeout. It's your data, your relationships, your identity."

Google Plus Fuss
- http://sunbeltblog.blogspot.com/2011/07/google-plus-fuss.html
July 05, 2011
___

- http://www.f-secure.com/weblog/archives/00002198.html
July 6, 2011 - "... Google will be deleting all private profiles after July 31*. This is related to Google+ migration..."
* http://www.google.com/support/profiles/bin/answer.py?hl=en&answer=1192471&p=public_profile

 Evil or Very Mad
« Last Edit: July 06, 2011, 14:21:43 by AplusWebMaster » Logged

This machine has no brain.
....... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.
« Reply #468 on: July 03, 2011, 03:53:33 »
AplusWebMaster Offline
Global Moderator WWW

Karma: 501
Posts: 8233



FYI...

Fake Google software emails
- http://msmvps.com/blogs/spywaresucks/archive/2011/07/02/1795605.aspx
Jul 2 2011 18:51 by sandi - Filed under: Malvertizing - "These almost fooled a family member. They’re fake. The spammers do the most basic of tracking – first by including remotely hosted pictures in the email, and by embedding the victim’s email address into URLs.  If you click on the link, even if you are well aware it’s fake and don’t intend to buy anything and have your internet security set to super-ultra-paranoid, they’re still going to know who clicked on that link and you’ll get even more junk..."
(Screenshots available st the URL above.)

 Sad Evil or Very Mad
Logged

This machine has no brain.
....... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.
« Reply #469 on: July 05, 2011, 03:36:34 »
AplusWebMaster Offline
Global Moderator WWW

Karma: 501
Posts: 8233



FYI...

Resurrection of MS10-087/CVE-2010-3333 In-The-Wild
- http://labs.m86security.com/2011/07/resurrection-of-cve-2010-3333-in-the-wild/
July 5, 2011 - "During the last few weeks we’ve seen massive use of the CVE-2010-3333 vulnerability for Microsoft Office. This eight months old vulnerability is used in popular documents such as a document that pretends to be “President Obama’s Speech”. Microsoft Office vulnerabilities have become very popular over the last few years and here are several samples that can be found In-The-Wild that use MS10-087 / CVE-2010-3333... The samples use different shellcodes, but as we can see, the exploit is In-The-Wild and is being used by malicious hackers..."

> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-3333
Last revised: 12/21/2010
CVSS v2 Base Score: 9.3 (HIGH)
___

- http://www.symantec.com/business/security_response/vulnerability.jsp?bid=44652

- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880

 Evil or Very Mad
« Last Edit: July 05, 2011, 09:37:26 by AplusWebMaster » Logged

This machine has no brain.
....... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.
« Reply #470 on: July 06, 2011, 19:14:53 »
AplusWebMaster Offline
Global Moderator WWW

Karma: 501
Posts: 8233



FYI...

Google dumps 11+ million .co.cc sites from search results...
- http://www.theregister.co.uk/2011/07/06/google_cans_11m_dot_co_dot_cc_sites/
6 July 2011 - "Google has removed over 11 million .co.cc websites from its search engine results pages on the basis that most of them are far too "spammy"... Google classes the firm as a "freehost", and has exercised its right to block the whole domain "if we see a very large fraction of sites on a specific freehost are spammy or low-quality", according to Matt Cutts, head of Google's web spam team... According to a recent report from the Anti-Phishing Working Group, the .cc top-level domain hosted 4,963 phishing attacks in the second half of 2010, almost twice the number found under any other extension. That was due to a large number of attacks originating from .co.cc addresses, the APWG said..."

 Exclamation
Logged

This machine has no brain.
....... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.
« Reply #471 on: July 07, 2011, 08:12:29 »
AplusWebMaster Offline
Global Moderator WWW

Karma: 501
Posts: 8233



FYI...

Virus Outbreak In Progress...
- http://www.ironport.com/toc/

- http://tools.cisco.com/security/center/threatOutbreak.x?currentPage=1&sortOrder=d&pageNo=1&sortType=d

Fake Money Order Attachment - E-mail - Updated July 07, 2011
> http://tools.cisco.com/security/center/viewAlert.x?alertId=23578
Fake FedEx Package Delivery Failure - E-mail- Updated July 07, 2011
> http://tools.cisco.com/security/center/viewAlert.x?alertId=23577
Fake Legal Department Payment - E-mail - July 7, 2011
> http://tools.cisco.com/security/center/viewAlert.x?alertId=23590
Fake Credit Card Overdue - E-mail - July 07, 2011
> http://tools.cisco.com/security/center/viewAlert.x?alertId=23589
Fake USPS Package Delivery - E-mail - Updated July 07, 2011
> http://tools.cisco.com/security/center/viewAlert.x?alertId=23529
Fake UPS Package Delivery - E-mail - Updated July 07, 2011
> http://tools.cisco.com/security/center/viewAlert.x?alertId=23197

 Evil or Very Mad
Logged

This machine has no brain.
....... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.
« Reply #472 on: July 18, 2011, 08:39:25 »
AplusWebMaster Offline
Global Moderator WWW

Karma: 501
Posts: 8233



FYI...

SBS hacked...
- http://www.sbs.com.au/article/124519/SBS-website-statement-July-18-2011
July 18, 2011 - "Over the last 2 days, the SBS website has been the victim of a hacking attack... this source has been able to enter the site on this occasion and has inserted a link to a third party ‘malware site’. Users who may have inadvertently visited this third party malware site could then have had their machines infected with a virus depending on their security settings. SBS recommends that any site users who may be concerned about infection run a full security scan... Our digital team has been working throughout the weekend to rectify the problem and have now resolved the problem. Investigations are ongoing regarding how this issue occurred and what steps can be taken to ensure it does not happen again..."

 Evil or Very Mad Exclamation Sad
Logged

This machine has no brain.
....... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.
« Reply #473 on: July 19, 2011, 09:51:25 »
AplusWebMaster Offline
Global Moderator WWW

Karma: 501
Posts: 8233



FYI...

Virus Outbreak In Progress...
- http://www.ironport.com/toc/
July 19, 2011

- http://tools.cisco.com/security/center/threatOutbreak.x?currentPage=1&sortOrder=d&pageNo=1&sortType=d

Fake Personal Loan Notification E-mail Messages...
- http://tools.cisco.com/security/center/viewAlert.x?alertId=23677
Fake Tax Backlog Notification E-mail Messages...
- http://tools.cisco.com/security/center/viewAlert.x?alertId=23679
Fake VISA Customer Services Notification E-mail Messages...
- http://tools.cisco.com/security/center/viewAlert.x?alertId=23678
Fake Purchase Notification E-mail Messages...
- http://tools.cisco.com/security/center/viewAlert.x?alertId=23662
Fake Notification E-mail Messages...
- http://tools.cisco.com/security/center/viewAlert.x?alertId=23660
Fake Profile Picture E-mail Messages...
- http://tools.cisco.com/security/center/viewAlert.x?alertId=23663
Fake Image Screen Shot E-mail Messages...
- http://tools.cisco.com/security/center/viewAlert.x?alertId=23656

 Evil or Very Mad
Logged

This machine has no brain.
....... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.
« Reply #474 on: July 19, 2011, 17:08:54 »
AplusWebMaster Offline
Global Moderator WWW

Karma: 501
Posts: 8233



FYI...

Python: No such file or directory – Your site is likely compromised
- http://blog.sucuri.net/2011/07/python-no-such-file-or-directory-your-site-is-likely-compromised.html
July 18, 2011 - "If you run a WordPress site and you are seeing the following error at the top of your pages:
    sh:  /usr/local/bin/python: No such file or directory
It means that it is likely compromised. How do we know that? We were tracking a large blackhat SEO spam campaign (targeting WordPress sites) and we noticed that for the last few days one of their link distrubution domains were broken and generating an error. So any hacked site would display that error instead of showing the spammy links... If you are unsure if your site is compromised, try doing a quick scan here:
http://sitecheck.sucuri.net  ..."

 Evil or Very Mad Exclamation
« Last Edit: July 20, 2011, 08:32:05 by AplusWebMaster » Logged

This machine has no brain.
....... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.
« Reply #475 on: July 21, 2011, 10:21:34 »
AplusWebMaster Offline
Global Moderator WWW

Karma: 501
Posts: 8233



FYI...

m86 Security Report - 1H 2011
- http://www.m86security.com/documents/pdfs/security_labs/m86_security_labs_report_1h2011.pdf
July 20, 2011 - "... During this period, Web-based threats continued to grow more sophisticated. However, email threats such as spam decreased markedly following the takedown of major spam operations. Key Points:
• Many of the vulnerabilities targeted today are found in the Adobe and Java platforms. This highlights the fact that these applications often remain unpatched. Organizations and individuals should ensure that these software applications are patched promptly.
• Although spam volumes have declined since the closure of Spamit.com and takedown of the Rustock botnet, spam remains a problem for most organizations. The volume of malicious spam has returned to previous levels. Attackers continue to craft more legitimate looking messages in order to coax users into executing malicious files.
• Cybercriminals continue to experiment with combined attacks, evidenced by the recent spate of “spear-phishing” (target attacks that used Microsoft Office document files with embedded shockwave files that exploit vulnerabilities in Adobe Flash).
• There has been an increase in phishing attacks that include an HTML attachment, which is used to bypass anti-spam an anti-phishing filters in the browser.
Facebook scams surged in the first half of 2011, as cybercriminals experimented with different ways to dupe social networkers into helping them earn a profit. One scam led users to trojans and fake anti-virus software for the Mac..."
(More detail in the PDF at the URL above.)

 Shocked
Logged

This machine has no brain.
....... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.
« Reply #476 on: July 21, 2011, 10:41:56 »
AplusWebMaster Offline
Global Moderator WWW

Karma: 501
Posts: 8233



FYI...

Fake Java Update uses victim PC's in DDoS...
http://www.malwarecity.com/blog/fake-java-update-uses-your-pc-in-ddos-offensive-1113.html
20 July 2011 - "Software patches, allegedly missing codecs and Flash Player or Java updates have been quite often used as baits in order to lure computer users into installing malware. We have recently come across this type of malware dissembling as a regular update to the Java platform. Closer investigation on the file revealed more than meets the eye: a carefully-crafted piece of malware that is extremely viral (i.e. spreads using an array of media) and can be used as a powerful tool to initiate distributed denial-of-service attacks. This e-threat seems to be in-sync with the canvas of on-line attacks we’ve been witnessing lately, especially those attributed to the independent hacktivist groups, such as Anonymous or their spin-off (and now defunct) organization called LulzSec. Both groups made a habit of targeting a wide range of institutions, including companies and government organizations not as much for money but as part of their “Antisec” credo. Backdoor.IRCBot.ADEQ is a Trojan disguised as a Java update. It is extremely “contagious”, as it can be downloaded from a multitude of locations, most of them being legit websites that have been infected by the tool... Backdoor.IRCBot.ADEQ uses private messages in order to communicate with its master, who sends the bot an assortment of commands, including the URL of a particular website the malware needs to flood... On top of that, the bot proceeds to uninstalling other bots such as Cerberus, Blackshades, CyberGate, or OrgeneraL DDoS Bot Cryptosuite if found injected into winlogon.exe, csrss.exe and services.exe. This is an essential step for the bot to ensure that the user doesn’t suspect any malicious activity on the computer, as well as to ensure that all the other pieces of malware racing for network bandwidth won’t get it. Plus, the bot also tries to prevent the user from noticing that the Trojan is constantly sending data to the Internet. It successfully adds itself to the list of authorized applications in the Windows Firewall, and tries to kill firewall alerts issued by antivirus solutions when they pop up. This makes Backdoor.IRCBot.ADEQ an efficient DDoS tool to be used by an attacker to take down sites or hinder the activity of a particular company...In the recent security landscape, Anmonymous and LulzSec have launched a couple of DDoS attacks against high-profile institutions. While the open-source Low-Orbit Ion Cannon tools have played a role in orchestrating the incident, most of the power was provided by botnets, as most permanent members of the organization “herd” botnets ranging between 5 and 30,000 infected machines. Botnets are universal tools of trade... A company might also get blackmailed and asked to pay a specific amount of money, or their servers will automatically be flooded with connection requests which it will be unable to answer, causing it to collapse. In the meanwhile, the company loses potential customers and, implicitly, money."

Hat-tip to cnm @ spywareinfoforum.com for the link...

 Shocked Evil or Very Mad
Logged

This machine has no brain.
....... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.
« Reply #477 on: July 22, 2011, 10:25:16 »
AplusWebMaster Offline
Global Moderator WWW

Karma: 501
Posts: 8233



FYI...

Fake Flash updates...
- http://sunbeltblog.blogspot.com/2011/07/correct-version-aversion.html
July 22, 2011 - "... they're hoping the victims they attract to a scam like this won't pay much attention to what they're clicking on, never mind confirm that the Flash numbering offered matches up with reality. We detect this as VirTool.Win32.Obfuscator.hg!b1 (v), another 2GCash clickfraud Trojan**, and the VirusTotal score is currently at 5/43*."
* http://www.virustotal.com/file-scan/report.html?id=ef8f8dc5bde18e428e9cef1b1293e13f93bf513688631102bab3b07287ccaa77-1311346336
File name: install.52078.exe
Submission date: 2011-07-22 14:52:16 (UTC)
Result: 5/43 (11.6%)

** http://sunbeltblog.blogspot.com/2011/07/update-center-targets-chrome-and.html

 Evil or Very Mad
Logged

This machine has no brain.
....... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.
« Reply #478 on: July 26, 2011, 04:22:17 »
AplusWebMaster Offline
Global Moderator WWW

Karma: 501
Posts: 8233



FYI...

Google AdWords phishing attack...
- http://nakedsecurity.sophos.com/2011/07/26/google-adwords-phishing-attack-strikes-inboxes/
July 26, 2011 - "Have you received an email from Google saying that your Google AdWords campaign may have stopped running?... The messages have been spammed out across the internet, attempting to trick users into visiting a bogus website that pretends to be the Google AdWords login page... It's a realistic replica of the main Google AdWords page, created with some care in an attempt to phish your credentials off you. And don't forget, your same username and password will be not just used by Google AdWords, but also Gmail, Google Docs, Google+ and so forth... In short, your Google username and password are a very attractive commodity to phishers..." (from google-oa .net) That's certainly not Google, and the fact that the domain has only just been registered makes it even more suspicious..."

 Evil or Very Mad
Logged

This machine has no brain.
....... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.
« Reply #479 on: July 26, 2011, 14:03:44 »
AplusWebMaster Offline
Global Moderator WWW

Karma: 501
Posts: 8233



FYI...

Mass injection - willysy .com...
- http://www.malwaredomains.com/wordpress/?p=1956
July 26th, 2011 - "Armorize reports* on a mass injection of 90,000 infected pages (not sites). The injected iframe points to willysy .com. We’ll be adding those domains on tonight’s update, but please read the article and take immediate action if you can."
* http://blog.armorize.com/2011/07/willysycom-mass-injection-ongoing.html
7.25.2011

 Evil or Very Mad
Logged

This machine has no brain.
....... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.
 
Pages: 1 ... 30 31 [32] 33 34 ... 83   Go Up
  Print  
 
Jump to:  

Powered by SMF 1.1.19 | SMF © 2013, Simple Machines Page created in 0.252 seconds with 19 queries.