A massive new spam campaign is using some devious tricks — including spoofing some of the world’s biggest brands
That $1,000 prize didn’t come from MSN
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Hackers have found a way to send spam emails that appear to hvae originated from trusted organizations, including some of the world’s biggest brands, in a new campaign that has been described as “massive”.
The messages themselves are what you’d usually expect from a phishing email: a series of redirections generating revenue via fraudulent ads, fake giveaways, affiliate scams, and similar, according to Guardio Labs, which believes the campaign has been active since at least 2022.
Some of the companies abused in this campaign include MSN, VMware, McAfee, The Economist, Cornell University, CBS, NYC.gov, PWC, Pearson, Better Business Bureau, Unicef, ACLU, Symantec, Java.net,Marvel, and eBay.
Major campaign
Every day of the campaign, some five million emails were being sent. The researchers can’t determine exactly how much money was made through the campaign, but claim that it’s undoubtedly a lot.
In total, more than 8,000 legitimate internet domains, as well as 13,000 subdomains have been abused in the campaign, which was later dubbed “SubdoMailing”.
Guardio Labs recently analyzed one such email that seemed to have come from MSN, sent by a threat actor known as ResurrecAds.
The threat actor scanned the internet for subdomains of reputable brands with CNAME records pointing to expired external domains, and once found, registered them via NameCheap.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Once registered with NameCheap, the hackers “hijack” the domain and send spam and phishing emails. They have also hosted phishing pages and deceptive advertising which, on the victim’s side, would seem as if a reputable, trusted brand was sending the email.
The hackers have also been scanning the internet for SPF records of target domains using the “include:” configuration option that pointed to defunct external domains, for the same results. With “include:”, the attackers were able to import allowed email senders from the external domain. Consequently, all of the emails would pass throughsecurity checksand land straight into people’s inboxes.
ViaBleepingComputer
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
Phishing attacks surge in 2024 as cybercriminals adopt AI tools and multi-channel tactics
