UCSF IT Technology

Cybercriminals have launched a series of phishing attacks using timely tax-themed lures. While the email from field says “Irs notice” and then the name of the organization, the sending address is a Madwire account.The phishing emails contain an HTML attachment allegedly containing delivery details about a tax related USPS letter. Opening the attachment leads to a lookalike Microsoft login page designed to steal credentials.

Cybercriminals have launched a series of phishing attacks impersonating the legitimate law firm, including Latham & Watkins.

Cybercriminals are increasingly using phishing-as-a-service kits to build and distribute lookalike Microsoft Office 365 landing pages via phishing lures.  The phishing lures can be customized to have a variety of different appearances or themes.

Cybercriminals have launched phishing attacks using malicious invoice-themed attachments to spread malicious software (malware).The phishing attacks hijack legitimate email threads to deliver the phishing lures to further increase the believability of the attacks. This means the lures may appear to be response to previous, legitimate email conversations.The malicious attachments used in this campaign are extremely large, zipped Microsoft Word files.

Cybercriminals have launched multiple phishing attacks attempting to take advantage of the humanitarian crisis in Turkey and Syria following the earthquake. These attacks are intended to steal recipient’s funds or to lead to the installation of malicious software (malware).  As multiple attacks are exploiting this crisis, lures will appear different.

Recent email-based attacks have abused Microsoft’s legitimate OneNote application to share malicious files. The emails use subject lines like “New Document Shared with you” and encourage the recipient to follow a link to view a shared OneNote file.  The OneNote link leads recipients to a shared document which contains the text “DOUBLE CLICK TO DOWNLOAD THE FILE NOW.”Some attacks may also distribute similar malicious OneNote files as email attachments.

Cybercriminals have launched phishing attacks impersonating Twitter Services. The emails include links to lookalike landing pages that are designed to steal Twitter credentials and phone numbers.While the email display names make it appear the messages come from “Twitter Services,” the actual sending address is a Gmail account.The emails use the proposed change at Twitter of charging verified users a monthly fee to maintain their verification status.

Cybercriminals have launched numerous, different phishing attacks using timely tax-themed lures. As multiple attacks are leveraging this topic, the lures will appear different. Lures may attempt to impersonate tax or revenue agencies, as well as companies or individuals asking for or offering to provide tax-related services.

Cybercriminals have launched phishing attacks claiming to be senior executives offering employees a Valentine’s Day-themed reward in appreciation of their work.  The message purporting to be from executives might compel users to engage with the supposed employer-related communications.