Buy now and install on all your devices from one easy email. X

Spamvertised Paypal

Sticking to their well proven social engineering tactics consisting of systematic rotation of the abused brands, cybercriminals are currently spamvertising millions of emails impersonating PayPal, in an attempt to trick end and corporate users into interacting with the malicious campaign.

Once the interaction takes place, users are exposed to the client-side exploits served by the Black Hole exploit kit, currently the market share leader within the cybercrime ecosystem.

More details:

We digress. Here's the list:

Screenshot of the spamvertised email:

Spamvertised Paypal

Upon clicking on the link, users are exposed to bogus "Page loading…" page:

Bogus Page Loading page

Spamvertised URLs: hxxp://earbudsforrunning.com/welcpp.html; hxxp://vitva-musicgroup.com/wp-content/uploads/fgallery/traninfo.html; hxxp://imune.org.br/traninfo.html

Client-side exploit serving URL: hxxp://teloexpressions.org/main.php?page=9aca5bbc34d3ebd6

Client-side exploits served: CVE-2010-0188; CVE-2010-1885

Detection rate for a sample redirection script: MD5: 2276947d2f3a7abc88e89089e65dce23

Upon successful client-side exploitation, the campaign drops MD5:
05e0958ef184a27377044655d7b23cb0 on the affected hosts, detected by 28 out of 41 antivirus scanners as Trojan.Generic.KDV.679870; Trojan-Dropper.Win32.Dapato.bnej.

Upon execution the sample phones back to a well known command and control server - 87.204.199.100/mx5/B/in/ which we've already seen in several previously profiled malware-serving campaigns.

As we've already predicted, the cybercriminal or gang of cybercriminals behind these persistent and massive spam campaigns will simply continue rotating the impersonated brands in an attempt to target millions of users across multiple Web properties.

PayPal has information on their website to help users identify legitimate emails.

Webroot SecureAnywere users are proactively protected from this threat.

You can find more about Dancho Danchev at his LinkedIn Profile. You can also follow him on Twitter.

DISCUSS IT HERE

Past Newsletters

2014 Newsletters
March Newsletter
June Newsletter
2013 Newsletters
October Newsletter
July Newsletter
April Newsletter
January Newsletter
2012 Newsletters
December Newsletter
November Newsletter
October Newsletter
September Newsletter
August Newsletter
July Newsletter
June Newsletter
May Newsletter
April Newsletter
March Newsletter
February Newsletter
January Newsletter
2011 Newsletters
December Newsletter
November Newsletter
October Newsletter
September Newsletter
August Newsletter
July Newsletter
June Newsletter