WhatsApp-themed spam campaign delivers malware
Posted on 16.12.2013
A new WhatsApp-themed spam campaign has been spotted targeting users of the popular IM service.

The spam email claims to be a notification about a voice message someone left for the recipient:

"The e-mail looks legit, and even the link is formed to make it look like a voicemail link with the little '/play' ending," points out SANS ISC CTO Johannes Ullrich.

But the thing that fascinated him the most is that the executable offered for download is adjusted to show a phone number that matches the location of the IP address from which the e-mail is downloaded from.

For example, downloading it from a computer located in his home got him VoiceMail_Jacksonville_(904)458abcd.exe, and from a server in Wayne, Pennsylvania resulted in VoiceMail_Wayne_(610)458abcd.exe (the last four digits have been obfuscated).

The file contains a spyware variant that is currently detected by only 8 out of the 49 AV solutions used by VirusTotal.

Another interesting thing is that, once run, the malware triggers Windows' Notepad and the text file contains the following notification: "Unknown ERROR! Please wait and try again later"

This is likely done to make users believe that the file they've tried to open is corrupted and can't be opened, and to prevent them to become suspicious and search for covertly installed malware.


Pen-testing drone searches for unsecured devices

You're sitting in an office, and you send a print job to the main office printer. You see or hear a drone flying outside your window. Next thing you know, the printer buzzes to life and, after spitting out your print job, it continues to work and presents you with more filled pages than you expected.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Oct 9th