AT&T Impersonated in Malware Download Attack

May 21, 2020

It’s common practice for companies to send notification emails with purchase receipts and tracking information, especially for purchases that are on the expensive side. However, for individuals who have not made recent purchases, this can be alarming, as these emails could signal fraudulent charges to the user’s credit card.

In this case, an attacker spoofed a notification email from AT&T. The goals was to encourage the target to investigate these charges, and by doing so, to inadvertently download malware.

Summary of Attack Target

  • Platform: Microsoft Office 365
  • Email Security Bypassed: FireEye
  • Victims: Employees
  • Payload: Malware
  • Technique: Spoofed Email + Impersonation

Overview of AT&T Impersonation Malware Attack

The email appears to be an automated notification regarding the order status of a recent purchase. The sender email looks like it comes from an authentic AT&T email address, and the images embedded in the body are the same as those used by the brand. However, checking the header IPs of the email, we are able to verify that the sender information is spoofed. We would expect the IP of an authentic email from AT&T to come from AT&T. This email, however, originated from an IP address in Ghana.

The email contains a link claiming to be the order details of the transaction. However, clicking on the link automatically downloads a .jar file that contains malware. The download is hosted at a site that is commonly used to store various malware downloads.

Should recipients fall victim to this attack, their device would be infected with malware. This would allow the attacker to steal sensitive personal information and potentially hijack the user’s device.

Why the AT&T Impersonation Malware Attack is Effective

The sender email was spoofed to impersonate a legitimate email address used by AT&T Wireless to send tracking notifications to customers. The email body itself perfectly matched legitimate emails sent by this AT&T email address—the formatting, the embedded images, and the content were identical. The only differences were the links attached to the email. The attacker anticipates that since the sender and the email appear authentic, recipients would be less suspicious of the downloaded malware file.

In addition, the malware URL is wrapped with text in the email body in order to conceal the link used by the attacker. The link directs to a download hosted at a page the attacker likely controls which is not affiliated with AT&T.

Abnormal can detect this attack as a result of a variety of factors. Most notably, DMARC email authentication fails for the sending address, and the sender has never before sent to anyone within the organization. Furthermore, content analysis shows that there is a suspicious link and that the message appears to come from an automated system, which is common method of email attack.

To discover more about how Abnormal can protect your organization from malware and other advanced attacks, see a demo today.


Prevent the Attacks That Matter Most

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Demo 2x 1

See the Abnormal Solution to the Email Security Problem

Protect your organization from the attacks that matter most with Abnormal Integrated Cloud Email Security.

Related Posts

B 10 3 22 Cobalt Terrapin Blog
Threat group Cobalt Terrapin uses sophisticated impersonation techniques with multiple steps to commit invoice fraud.
Read More
B 09 29 22 CISO Cybersecurity Awareness Month
October is here, which means Cybersecurity Awareness Month is officially in full swing! These five tips can help security leaders take full advantage of the month.
Read More
B Email Security Challenges Blog 09 26 22
Understanding common email security challenges caused by your legacy technology will help you determine the best solution to improve your security posture.
Read More
B 5 Crucial Tips
Retailers are a popular target for threat actors due to their wealth of customer data and availability of funds. Here are 5 cybersecurity tips to help retailers reduce their risk of attack.
Read More
B 3 Essential Elements
Legacy approaches to managing unwanted mail are neither practical nor scalable. Learn the 3 essential elements of modern, effective graymail management.
Read More
B Back to School
Discover how threat group Chiffon Herring leverages impersonation and spoofed email addresses to divert paychecks to mule accounts.
Read More
B 09 06 22 Rearchitecting a System Blog
We recently shared a look at how the Abnormal engineering team overhauled our Unwanted Mail service architecture to accommodate our rapid growth. Today, we’re diving into how the team migrated traffic to the new architecture—with zero downtime.
Read More
B Industry Leading CIS Os
Stay up to date on the latest cybersecurity trends, industry news, and best practices by following these 12 innovative and influential thought leaders on social media.
Read More
B Podcast Engineering 11 08 24 22
In episode 11 of Abnormal Engineering Stories, David Hagar, Director of Engineering and Abnormal Head of UK Engineering, continues his conversation with Zehan Wang, co-founder of Magic Pony.
Read More