Scammers target job seekers with sophisticated money stealing scheme

Kaspersky Lab experts detected a blast of sophisticated spam emails in the first quarter of 2019, featuring fake job offers that seemed to come from HR recruiters in large corporations that traditionally attract a lot of interest from potential employees. However, the emails actually came from spammers and installed money -stealing malware on users’ devices.

Spam emails are an often underestimated threat, yet they can spread malware through social engineering methods like deception and psychological manipulation, and claim many victims.

To track such emails, Kaspersky Lab researchers use honeypots – virtual ‘traps’ able to detect malicious emails and catch threat actors. For this particular operation, they tracked fraudsters trying to exploit unwary people looking for a new role.

Analysis of the findings from the honeypots is included in the new Spam and Phishing in Q1 2019 report. This shows that recipients of the spam emails were offered a tempting position in a large company. They were invited to join a job search system for free by installing a special application on their device that would provide access to the job-search database.

To make the installation process look trustworthy, the attackers accompanied it with a pop-up window carrying the words “DDoS Protection” and a fake message that claimed the user was being redirected to the website of one of the largest recruitment agencies.

Screenshot of malicious e-mail sample and a pop-up window

In fact, victims were redirected to a cloud storage site from where they would download a malicious installer that looked like a word file. Its function was to download to the victim’s machine the infamous Gozi banking trojan, one of the most commonly used malware for stealing money. Kaspersky Lab detects it as Trojan-Banker.Win32.Gozi.bqr

“We often see spammers using names of large and well known companies –– it helps them to succeed in their malicious business and gain people’s trust. Famous brands with a solid reputation can become victims of fraudsters who pretend to be them and lure unsuspecting users into downloading a malicious attachment to their computers. This particular scheme involved the names of both well known recruiting companies and respected businesses, which made it even more sophisticated. One needed to check the email address line for errors to suspect that the job offer was not authentic,” said Maria Vergelis, a security researcher at Kaspersky Lab.

To avoid falling victim to malicious spam, users are advised to:

• Always check the web address of a website you are redirected to, or the link address and the sender’s email, to ensure they are genuine before clicking on them, and make sure that the name of link in the message doesn’t cover another hyperlink.
• Do not click on links in emails, texts, instant messaging or social media posts if they come from people or organizations you don’t know, or have suspicious or unusual addresses. Make sure they are legitimate and start with ‘https’ whenever any personal or financial information is asked for.
• If you are not sure that the company website is real and safe, never enter your personal information.
• Check the company’s official website for open vacancies matching your job skills.
• Make an additional phone call to the company to be sure that the job-offer is real.
• Review your job offer for possible mistakes: carefully check the company name or job title and responsibilities.
• Use a reliable security solution for comprehensive protection from a wide range of threats, such as Kaspersky Security Cloud

Other findings of the report include:

Phishing:

• In Q1 2019, the Kaspersky Lab’s anti-phishing module prevented 111,832,308 attempts to direct users to scam websites. This is a 24% increase compared to the Q1 2018 figure, which was 90,245,060.
• The banking sector has become the number one target, followed by global internet portals and payment systems.
• Brazil was the country with the largest share of users attacked by phishers in the first quarter of 2019 (22% compared to 19% in Q1 2018). It was followed by Austria (17%) and Spain (17%).

Spam:

• In the first quarter of 2019, the amount of spam peaked in March (56.3%). The average share of spam in the world’s email traffic was 56%, which is 4% more than in Q1 2018.
• China (16%) was the most popular source of spam, followed by the United States (13%) and Russia (7%).
• The country most targeted by malicious mailshots was Germany with 12%. Vietnam came second with 6%, followed by  Russia (5%).

Read the full version of the report on Securelist.com.