Xerox Color Workstation Email
Xerox Color Workstation Email is the designation given to a campaign distributing malicious spam emails that carry keylogger malware. The lure used by the bad actors behind the campaign is a message urging the victim to open what appears to be a scanned file, produced on a Xerox Color workstation. Even though that's what the message and email title say, the attached file is really a malicious keylogger.
The attached file would commonly be named Declaration_Report.doc and pose as a regular Microsoft Word file. However, the file contains malicious macros. Once opened, the file will ask for permission to enable macros and if permission is granted, it will download and install the Hawkeye keylogger on the victim's system.
Keyloggers are malicious tools used by hackers to obtain information about every keystroke that the user makes on the infected system. This means that the information exposed to the hackers operating the keylogger is virtually unlimited - all your correspondence, direct messaging over applications and all your logins that you type in instead of using autofill will be captured and sent to the keylogger operator. The potential for exposure of both personal information and your bank accounts and logins for various services with a malicious keylogger installed is immense.
The Xerox Color Workstation email campaign is just one of the many similar malicious spam campaigns run by bad actors. The lure in the email title can be different, but the outcome is always the same - once the victim opens the malicious attachment, the malware associated with the campaign is downloaded and installed on the system. This particular campaign carries a keylogger, but similar spam campaigns have been used to spread banking Trojans, backdoors and even ransomware.
The malware contained in email attachments can take many forms. Word files are just one option. Fake Adobe PDF files, fake images and other popular file types that users usually don't hesitate to open are used as malware vehicles too. Bear in mind that just because the file looks like a harmless file, that doesn't mean it is really that.
The best way to stay safe when dealing with similar spam emails is to never open or even touch the attachments at all. A lot of the time your email provider will scan the attached files and will detect the malicious content, but sometimes the malware can slip by those filters. That is why the safest bet is simply never to open any attachments when the email you received is unsolicited and you do not personally know and recognize the sender.
Of course, keeping a reliable anti-malware suite installed on your system will also help a lot with keeping out malware similar to the Hawkeye keylogger spread in the Xerox Color Workstation spam campaign.
