© 2023 CyberNews - Latest tech news,
product reviews, and analyses.

If you purchase via links on our site, we may receive affiliate commissions.

Attackers peddle malware via blank email images


Threat actors try scamming users out of their assets, hiding malicious URLs in empty image files, and bypassing antivirus defenses.

Attackers discovered a way to bypass antivirus services like VirusTotal, implanting malware in “blank images” on emails, researchers at Avanan, a Check Point Software company, have discovered.

“Hackers can target practically anyone with this technique. Like most attacks, the idea is to use it to get something from the end-user. Any user with access to credentials or money is a viable target,” Jeremy Fuchs, a cybersecurity researcher at Avanan, told Cybernews.

As with most phishing attacks, threat actors target victims via email. The campaign presents potential victims with a fraudulent document supposedly originating from DocuSign, an electronic agreements management service.

“Hackers can target practically anyone with this technique. Like most attacks, the idea is to use it to get something from the end-user. Any user with access to credentials or money is a viable target.”

Fuchs told Cybernews.

Targeted users are asked to review and sign the document. Interestingly, unlike other phishing campaigns, the link takes users to a legitimate DocuSign page.

That way, attackers trick the victim into trusting the overall email. However, the real danger lurks in the HTM attachment sent together with the DocuSign link.

According to the researchers, the attachment contains an SVG image encoded using Base64, a binary-to-text encoding scheme. While the image is empty, the file still contains active content, a Javascript redirecting to the malicious URL.

“What is new and unique is using an empty image with active content inside--a javascript image--which redirects to a malicious URL. It’s essentially using a dangerous image, with active content inside that traditional services like VirusTotal don’t detect,” Fuchs explained.

In essence, the attackers coax users into trusting the fraudulent email, which leads some of the victims to trust the attachment. However, clicking the attachment leads to a malicious site where scammers start casting their nets.

Researchers note that the attack is particularly crafty since, by layering obfuscation upon obfuscation, most security services are helpless against this attack.

To avoid falling victim to such attacks, users are advised to be cautious of any email that contains HTML or .htm attachments. At the same time, security administrators might consider blocking all HTML attachments.


More from Cybernews:

Tech totalitarianism: are we close to the point of no return?

Mass layoffs in tech potential cybersecurity risk

Ukraine blames Sandworm for wiper attack on news agency

US cracks down on crypto business laundering money for Russian criminals

FTX admits $400m hack but declares $5.5bn in digital assets

Subscribe to our newsletter



Leave a Reply

Your email address will not be published. Required fields are marked