Microsoft Tracks New Malware Campaign Using Call Center Scam
Security researchers with Microsoft's cybersecurity division are warning the public about a new two-staged malware attack that ultimately seeks to deploy ransomware on the victim's system. The threat actors running the malware campaign are using real phone operators to spread the malware.
The first step of the malware attack involves the victim receiving a phishing email. The email's text uses clever social engineering to scare the victims into action. The letter urges the recipient to call a fake support phone number in order to cancel a trial subscription which will supposedly automatically transition to a paid one if not explicitly cancelled.
Once the user phones the fake call center support line, they are contacted by a live operator who works with the malware gang. The phone operator instructs the victim to visit a website where they need to download an Excel file to fill in if they want to cancel their non-existent subscription.
When the user downloads and opens the Excel file, a malicious macro contained in the spreadsheet file downloads the main payload. The malware used is named BazarLoader and installs a backdoor which the criminals can later use to execute a variety of malicious tasks. The backdoor gives the hackers the ability to upload additional malware to the victim system, scrape information from it as well as find and exploit other vulnerable machines connected to the same network.
Even though different phishing emails use different fake subscriptions as the bait, Microsoft is logically most focused on emails that spoof an Office 365 subscription and target Office users. Another challenge that Microsoft highlights in its post about the malware campaign is how difficult it is for anti-malware software to spot that the original phishing email is malicious. The phishing bait does not contain any malicious attachments nor any direct links to malicious domains and URLs, which makes early detection and flagging of the email as malicious particularly difficult.
Additionally, Microsoft noticed that the same malware group running the BazarLoader campaign also uses the CobaltStrike penetration testing kit. It serves the purpose of stealing user credentials, as well as lateral movement across a network after a single host system on it has been breaches and compromised.
