Scam of the Week: Phishing Campaign Abuses Contact Forms

Attackers are abusing websites’ contact forms to send malicious emails to the websites’ owners, according to researchers at Microsoft. The emails contain bogus copyright claims with a link to a sites.google.com page. Clicking the link will result in the installation of the IcedID banking Trojan.

“In the samples we found, attackers used legal threats as a scare tactic while claiming that the recipients allegedly used their images or illustrations without their consent, and that legal action will be taken against them,” the researchers write. “There is also a heightened sense of urgency in the email wording, with phrases such as ‘you could be sued,’ and ‘it’s not legal.’ It’s a sly and devious approach since everything else about this email is authentic and legitimate.”

Microsoft notes that these phishing emails will be hard to spot unless users are looking out for them, since the emails are generated by the websites’ real contact forms and the phishing link leads to a google.com domain.

“This campaign is not only successful because it takes advantage of legitimate contact form emails, but the message content also passes as something that recipients would expect to receive,” Microsoft says. “This creates a high risk of attackers successfully delivering email to inboxes, thereby allowing for ‘safe’ emails that would otherwise be filtered out into spam folders.”

The researchers conclude that this campaign shows how attackers are able to constantly adapt to bypass email security filters.

“As this research shows, adversaries remain motivated to find new ways to deliver malicious email to enterprises with the clear intent to evade detection” they write. “The scenarios we observed offer a serious glimpse into how sophisticated attackers’ techniques have grown, while maintaining the goal of delivering dangerous malware payloads such as IcedID. Their use of submission forms is notable because the emails don’t have the typical marks of malicious messages and are seemingly legitimate.”

Content provided by KnowBe4