The Microsoft 365 Defender Threat Intelligence Team has been tracking a new campaign in which attackers are abusing legitimate infrastructure including website contact forms and Google URLs to bypass email security filters.
According to Microsoft, these attacks begin with emails containing legal threats claiming that the recipient allegedly used their images or illustrations without consent and that legal action will be take against them. These emails create a sense of urgency as the recipients will likely want to avoid being sued and the site.google.com link used by the attackers makes their threats appear more legitimate.
Upon discovering the campaign, Microsoft reached out to Google’s security team which is already looking into the matter.
Microsoft’s Emily Hacker and Justin Carrol provided further insight on this new campaign in a blog post, saying:
“While this specific campaign delivers the IcedID malware, the delivery method can be used to distribute a wide range of other malware, which can in turn introduce other threats to the enterprise. IcedID itself is a banking trojan that has evolved to become an entry point for more sophisticated threats, including human-operated ransomware. It connects to a command-and-control server and downloads additional implants and tools that allow attackers to perform hands-on-keyboard attacks, steal credentials, and move laterally across affected networks to delivering additional payloads.”
As this new campaign is capable of delivering a wide range of malware, employees should be on the lookout for any suspicious emails claiming they violated copyright. They should also avoid clicking on any links in emails from unknown senders.