JavaScript spam attachment – Computer Security Articles

Don’t let this Black Friday/Cyber Monday spam deliver Locky ransomware to you

January 23, 2017 admin anti-malware, Antimalware research for IT pros and enthusiasts, Black Friday, Cyber Monday, JavaScript, JavaScript spam attachment, Locky, malware, MMPC, Nemucod, ransomware, research, spam, Windows Defender

We see it every year: social engineering attacks that take advantage of the online shopping activities around Black Friday and Cyber Monday, targeting customers of online retailers. This year, we’re seeing a spam campaign that Amazon customers need to be wary of. The fake emails pretend to be notifications from the online retailer that a purchase has…

Microsoft Security

Double-click me not: Malicious proxy settings in OLE Embedded Script

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, JavaScript, JavaScript spam attachment, JScript, JScript malware, JScript malware prevention, Macro-based malware, malware-prevention blog, mitigate OLE misuse, obfuscated JScript, OLE misuse mitigation, OLE-embedded objects, Social engineering, spam, spam email infection vector, Trojan, Trojan:JS/Certor.A, Trojan:PowerShell/Certor.A, Windows Defender

Attackers have been using social engineering to avoid the increasing costs of exploitation due to the significant hardening and exploit mitigations investments in Windows. Tricking a user into running a malicious file or malware can be cheaper for an attacker than building an exploit which works on Windows 10. In our previous blog, Where’s the…

Microsoft Security

Nemucod dot dot..WSF

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, JavaScript, JavaScript spam attachment, JS attachment, Nemucod, Nemucod infection chain, Nemucod mitigation, Social engineering, spam, Trojan, Windows Scripting File, WSF

The latest Nemucod campaign shows the malware distributing a spam email attachment with a .wsf extension, specifically ..wsf (with a double dot) extension. It is a variation of what has been observed since last year (2015) – the TrojanDownloader:JS/Nemucod malware downloader using JScript. It still spreads through spam email attachment, typically inside a .zip file,…

Microsoft Security

JavaScript-toting spam emails: What should you know and how to avoid them?

January 23, 2017 admin AppLocker Group Policy, backdoor, JavaScript spam attachment, JS/Locky, JS/Nemucod, JS/Swabfex, Locky, Nemucod, Rensomware payload, sample JavaScript email attachments, sample JavaScript spam, spam, spam email vector, Swabfex, Tecrypt, Trojan, Windows Defender

We have recently observed that spam campaigns are now using JavaScript attachments aside from Office files. The purpose of the code is straightforward. It downloads and runs other malware. Some of the JavaScript downloaders that we’ve seen are: TrojanDownloader:JS/Swabfex TrojanDownloader:JS/Nemucod TrojanDownloader:JS/Locky The same JavaScript downloaders are also responsible for spreading the following ransomware: Ransom:Win32/Tescrypt Ransom:Win32/Locky…