chat
expand_more

AT&T Impersonated in Malware Download Attack

It’s common practice for companies to send notification emails with purchase receipts and tracking information, especially for purchases that are on the expensive side. However, for individuals who have not made recent purchases, this can be alarming, as...
May 21, 2020

It’s common practice for companies to send notification emails with purchase receipts and tracking information, especially for purchases that are on the expensive side. However, for individuals who have not made recent purchases, this can be alarming, as these emails could signal fraudulent charges to the user’s credit card.

In this case, an attacker spoofed a notification email from AT&T. The goals was to encourage the target to investigate these charges, and by doing so, to inadvertently download malware.

Summary of Attack Target

  • Platform: Microsoft Office 365
  • Email Security Bypassed: FireEye
  • Victims: Employees
  • Payload: Malware
  • Technique: Spoofed Email + Impersonation

Overview of AT&T Impersonation Malware Attack

The email appears to be an automated notification regarding the order status of a recent purchase. The sender email looks like it comes from an authentic AT&T email address, and the images embedded in the body are the same as those used by the brand. However, checking the header IPs of the email, we are able to verify that the sender information is spoofed. We would expect the IP of an authentic email from AT&T to come from AT&T. This email, however, originated from an IP address in Ghana.

The email contains a link claiming to be the order details of the transaction. However, clicking on the link automatically downloads a .jar file that contains malware. The download is hosted at a site that is commonly used to store various malware downloads.

Should recipients fall victim to this attack, their device would be infected with malware. This would allow the attacker to steal sensitive personal information and potentially hijack the user’s device.

Why the AT&T Impersonation Malware Attack is Effective

The sender email was spoofed to impersonate a legitimate email address used by AT&T Wireless to send tracking notifications to customers. The email body itself perfectly matched legitimate emails sent by this AT&T email address—the formatting, the embedded images, and the content were identical. The only differences were the links attached to the email. The attacker anticipates that since the sender and the email appear authentic, recipients would be less suspicious of the downloaded malware file.

In addition, the malware URL is wrapped with text in the email body in order to conceal the link used by the attacker. The link directs to a download hosted at a page the attacker likely controls which is not affiliated with AT&T.

Abnormal can detect this attack as a result of a variety of factors. Most notably, DMARC email authentication fails for the sending address, and the sender has never before sent to anyone within the organization. Furthermore, content analysis shows that there is a suspicious link and that the message appears to come from an automated system, which is common method of email attack.

To discover more about how Abnormal can protect your organization from malware and other advanced attacks, see a demo today.

AT&T Impersonated in Malware Download Attack

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

 

See the Abnormal Solution to the Email Security Problem

Protect your organization from the full spectrum of email attacks with Abnormal.

 
Integrates Insights Reporting 09 08 22

Related Posts

B Most Interesting Attacks Q1 2024
Take a look at five of the most unique and sophisticated email attacks recently detected and stopped by Abnormal.
Read More
B MKT499 Images for Customer Blog Series
Discover key industry trends and insights from cybersecurity leader Michael Marassa, CTO of New Trier Township High School District 203.
Read More
B Construction Professional Services QR Code Attacks
Abnormal data shows construction firms and professional service providers are up to 19.2 times and 18.5 times, respectively, more likely to receive QR code attacks than organizations in other industries.
Read More
B 1500x1500 Evolving Abnormal R2
From the beginning, we created Abnormal Security to be a generational company that protects people from cybercrime. Here’s how we’re doing it.
Read More
Blog Cover 1500x1500 Images for SOC Time Blog
Discover the critical tasks that occupy SOC analysts’ schedules beyond mere inbox management, and discover insights into optimizing efficiency in cybersecurity operations.
Read More
B 1500x1500 MKT494 Top Women in Cybersecurity
In honor of Women's History Month, we're spotlighting 10 women leaders who are making invaluable contributions to cybersecurity.
Read More