A spam run detected by several security companies has attempted to deliver malware through an innovative technique: a link in a PowerPoint slideshow.
The attack steps like this:
- A malicious Microsoft PowerPoint Open XML Slide Show (PPSX) or PowerPoint Show (PPS) is delivered attached in a bogus email (invoice, purchase order, what have you)
- Victims download the file and run it, and are faced with a single text link (or hyperlinked picture) in the file
- They are puzzled by it, and hover with the mouse’s pointer over it in order to discover where the link will take them
- That simple move triggers a mouseover action that leads to a security warning pop-up (Microsoft disables the content of suspicious files by default via Protected View)
- Users who are still curious and allow the program to be run, either by clickling the Enable All or Enable button, start a chain reaction: an embedded malicious PowerShell script is executed that downloads another downloader in the form of a JScript Encoded File (JSE), which retrieves the final payload from a C&C server (in this case, a banking Trojan).
No comments:
Post a Comment