{"id":35262,"date":"2019-05-23T12:57:58","date_gmt":"2019-05-23T04:57:58","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=35262"},"modified":"2019-05-23T12:58:00","modified_gmt":"2019-05-23T04:58:00","slug":"scammers-target-job-seekers-with-sophisticated-money-stealing-scheme","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2019\/05\/23\/scammers-target-job-seekers-with-sophisticated-money-stealing-scheme\/","title":{"rendered":"Scammers target job seekers with sophisticated money stealing scheme"},"content":{"rendered":"\n

Kaspersky Lab experts detected a blast of sophisticated spam emails in the first quarter of 2019, featuring fake job offers that seemed to come from HR recruiters in large corporations that traditionally attract a lot of interest from potential employees. However, the emails actually came from spammers and installed money -stealing malware on users\u2019 devices.<\/strong><\/p>\n\n\n\n

Spam emails are an often underestimated threat, yet they can spread malware through social engineering methods like deception and psychological manipulation, and claim many victims. <\/p>\n\n\n\n

To track such emails, Kaspersky Lab researchers use honeypots \u2013 virtual \u2018traps\u2019 able to detect malicious emails and catch threat actors. For this particular operation, they tracked fraudsters trying to exploit unwary people looking for a new role.<\/p>\n\n\n\n

Analysis of the findings from the honeypots is included in the new Spam and Phishing in Q1 2019<\/em> report. This shows that recipients of the spam emails were offered a tempting position in a large company. They were invited to join a job search system for free by installing a special application on their device that would provide access to the job-search database. <\/p>\n\n\n\n

To make the installation process look trustworthy, the attackers accompanied it with a pop-up window carrying the words \u201cDDoS Protection\u201d and a fake message that claimed the user was being redirected to the website of one of the largest recruitment agencies.<\/p>\n\n\n\n

\"\"\/<\/figure><\/div>\n\n\n\n

Screenshot of malicious e-mail sample and a pop-up window<\/em><\/p>\n\n\n\n

In fact, victims were redirected to a cloud storage site from where they would download a malicious installer that looked like a word file. Its function was to download to the victim\u2019s machine the infamous Gozi banking trojan<\/a>, one of the most commonly used malware for stealing money. Kaspersky Lab detects it as Trojan-Banker.Win32.Gozi.bqr<\/p>\n\n\n\n

\u201cWe often see spammers using names of large and well known companies –\u2013 it helps them to succeed in their malicious business and gain people\u2019s trust. Famous brands with a solid reputation can become victims of fraudsters who pretend to be them and lure unsuspecting users into downloading a malicious attachment to their computers. This particular scheme involved the names of both well known recruiting companies and respected businesses, which made it even more sophisticated. One needed to check the email address line for errors to suspect that the job offer was not authentic,\u201d said Maria Vergelis, a security researcher at Kaspersky Lab. <\/p>\n\n\n\n

To avoid falling victim to malicious spam, users are advised to:<\/strong><\/p>\n\n\n\n