In this attack, attackers impersonate a notification from AT&T in order to install malware on the user’s device.
Platform: Microsoft Office 365
Mailboxes: 15,000 to 50,000
Email Security Bypassed: FireEye
Technique: Spoofed Email + Impersonation
What was the attack?
Setup: It’s common practice for industries to send notification emails with purchase receipts and tracking information. However, for individuals who have not made recent purchases, this can be alarming as these emails could signal fraudulent charges to the user’s credit card. In this case, an attacker spoofed a notification email for the purpose of getting the user to investigate these charges, to inadvertently download malware.
Email Attack: The email appears to be an automated notification regarding the order status of a recent purchase. The sender email looks like it comes from an authentic AT&T email address, and the images embedded in the body are the same as those used by the brand. However, checking the header IPs of the email, we are able to verify that the sender information is spoofed. We would expect the IP of an authentic email from AT&T to come from AT&T. This email, however, originated from an IP address in Ghana.
Payload: The email contains a link claiming to be the order details of the transaction. However, clicking on the link automatically downloads a .jar file that contains malware. The download is hosted at a site which is used to store various malware downloads.
Result: Should recipients fall victim to this attack, their device would be infected with malware. This would allow the attacker to steal sensitive personal information and potentially hijack the user’s device.
Why is this attack effective?
Spoofed Email and Sender: The sender email was spoofed to impersonate a legitimate email address used by AT&T Wireless to send tracking notifications to customers. The email body itself perfectly matched legitimate emails sent by this AT&T email address: the formatting, the embedded images, and the content were identical. The only differences were the links attached to the email. The attacker anticipates that since the sender and the email appear authentic, recipients would be less suspicious of the downloaded malware file.
Concealed URL: The malware URL is wrapped with text in the email body in order to conceal the link used by the attacker. The link directs to a download hosted at a page the attacker likely controls which is not affiliated with AT&T.