VB Blog

Alleged author of creepy FruitFly macOS malware arrested

Posted by   Martijn Grooten on   Jan 11, 2018

A 28-year old man from Ohio has been arrested on suspicion of having created the mysterious FruitFly malware that targeted macOS and used it to spy on its victims.

Read more  

The threat and security product landscape in 2017

Posted by   Martijn Grooten on   Jan 10, 2018

At the start of the new year, Virus Bulletin looks back at the threats seen in the 2017 and at the security products that are available to help mitigate them.

Read more  

Spamhaus report shows many botnet controllers look a lot like legitimate servers

Posted by   Martijn Grooten on   Jan 9, 2018

Spamhaus's annual report on botnet activity shows that botherders tend to use popular, legitimate hosting providers, domain registrars and top-level domains when setting up command-and-control servers.

Read more  

Tips on researching tech support scams

Posted by   Martijn Grooten on   Jan 5, 2018

As tech support scammers continue to target the computer illiterate through cold calling, VB's Martijn Grooten uses his own experience to share some advice on how to investigate such scams.

Read more  

Meltdown and Spectre attacks mitigated by operating system updates

Posted by   Martijn Grooten on   Jan 4, 2018

Just four days into the new year, two serious attacks in modern processors, dubbed Meltdown and Spectre, have been discovered. The attacks can be mitigated by patches to the operating system, but anti-virus software vendors need to make sure their products are compatible with the patches.

Read more  

Conference review: AVAR 2017

Posted by   Martijn Grooten on   Dec 22, 2017

Martijn Grooten reports on the 20th AVAR conference, which took place earlier in December in Beijing, China.

Read more  

Conference review: Botconf 2017

Posted by   Virus Bulletin on   Dec 22, 2017

Virus Bulletin researchers report back from a very interesting fifth edition of Botconf, the botnet fighting conference.

Read more  

VB2017 videos on attacks against Ukraine

Posted by   Martijn Grooten on   Dec 21, 2017

(In)security is a global issue that affects countries around the world, but in recent years none has been so badly hit as Ukraine. Today, we publish the videos of two VB2017 talks about attacks that hit Ukraine particularly badly: a talk by Alexander Adamov (NioGuard) on (Not)Petya and related attacks, and another by Robert Lipovsky and Anton Cherepanov (ESET) on Industroyer.

Read more  

Facebook helps you determine whether emails really came from its servers

Posted by   Martijn Grooten on   Dec 21, 2017

On its website, Facebook now shows which emails it has sent you recently, thus helping you to determine which emails are real, and which should be discarded as phishing.

Read more  

Vulnerability disclosure and botnet takedown not to be hindered by Wassenaar Arrangement

Posted by   Martijn Grooten on   Dec 19, 2017

Clarification in the language of the Wassenaar Arrangement, a multilateral export control regime for conventional arms and dual-use goods and technologies, means those involved in vulnerability disclosure or botnet takedown won't have to worry about acquiring an export licence.

Read more  
Previous1...2526272829...215Next

Search blog

The malspam security products miss: Emotet, Ursnif, and a spammer's blunder

The set-up of the VBSpam test lab gives us a unique insight into the kinds of emails that are more likely to bypass email filters. This week we look at the malspam that was missed: a very international email with a link serving Emotet, an Italian Ursnif c…
This blog post was put together in collaboration with VB test engineers Adrian Luca and Ionuţ Răileanu. Virus Bulletin uses email feeds provided by Abusix and Project Honey Pot.… https://www.virusbulletin.com/blog/2019/02/malspam-security-products-miss-emotet-ursnif-and-spammers-blunder/

The malspam security products miss: banking and email phishing, Emotet and Bushaloader

The set-up of the VBSpam test lab gives us a unique insight into the kinds of emails that are more likely to bypass email filters. This week we look at the malspam that was missed: banking and email phishing, Emotet and Bushaloader.
This blog post was put together in collaboration with VB test engineers Adrian Luca and Ionuţ Răileanu. Virus Bulletin uses email feeds provided by Abusix and Project Honey Pot.… https://www.virusbulletin.com/blog/2019/02/malspam-security-products-miss-banking-and-email-phishing-emotet-and-bushaloader/

From Amazon to Emotet: a look at those phishing and malware emails that bypassed email security products

We see a lot of spam in the VBSpam test lab, and we also see how well such emails are being blocked by email security products. Recently some of the emails that bypassed security products included a broken Amazon phishing campaign, a large fake UPS campai…
This blog post was put together in collaboration with VB test engineers Adrian Luca and Ionuţ Răileanu. On this blog, we regularly look at those phishing and malware emails… https://www.virusbulletin.com/blog/2019/02/amazon-ups-emotet-formbook-and-lokibot-look-those-phishing-and-malware-emails-bypassed-email-security-products/

From HSBC to product descriptions: the malicious emails bypassing your filters

Using data from our VBSpam lab, we looked at the malicious emails that have been missed recently by a large number of email security products.
Over a one-week period earlier this month, the average email with a malicious attachment was almost three times as likely to bypass email security products than a spam email… https://www.virusbulletin.com/blog/2019/01/hsbc-product-descriptions-malicious-emails-bypassing-your-filters/

The spam that is hardest to block is often the most damaging

We see a lot of spam in the VBSpam test lab, and we also see how well such emails are being blocked by email security products. Worryingly, it is often the emails with a malicious attachment or a phishing link that are most likely to be missed.
This blog post was put together in collaboration with VB test engineers Adrian Luca and Ionuţ Răileanu. In a talk I gave at IRISSCON last year (the video of which you will find… https://www.virusbulletin.com/blog/2019/01/spam-hardest-block-often-most-damaging/

$150k in cryptocurrency stolen through combined BGP-DNS hijack

A BGP hijack was used to take over some of Amazon's DNS infrastructure, which was then used to serve a phishing site to users of the MyEtherWallet service.
If the Internet is, as is often said, held together with elastic bands and pieces of Sellotape, BGP is essentially a bunch of post-it notes that serve as traffic signs. BGP… https://www.virusbulletin.com/blog/2018/04/150-k-cryptocurrency-stolen-through-cominbed-bgp-dns-hijack/

Facebook helps you determine whether emails really came from its servers

On its website, Facebook now shows which emails it has sent you recently, thus helping you to determine which emails are real, and which should be discarded as phishing.
There are many good reasons to criticize Facebook for its collecting of our personal data, but the company also deserves credit for being at the forefront when it comes to online… https://www.virusbulletin.com/blog/2017/12/facebook-helps-you-determine-whether-emails-really-came-them/

Firefox 59 to make it a lot harder to use data URIs in phishing attacks

Firefox developer Mozilla has announced that, as of version 59 of the browser, many kinds of data URIs, which provide a way to create "domainless web content", will not be rendered in the browser, thus making this trick - used in various phishing campaign…
While a domain name is really just a short string, this string comes with a large amount of implicit metadata: the registration date; the IP address(es) the domain currently… https://www.virusbulletin.com/blog/2017/11/firefox-59-make-it-lot-harder-use-data-uris-phishing-attacks/

DMARC: an imperfect solution that can make a big difference

US Senator Ron Wyden has asked the Department of Homeland Security to implement DMARC. Martijn Grooten looks at what difference this could make for phishing attacks impersonating the US federal governent.
US Senator Ron Wyden has written a letter (pdf) to the Department of Homeland Security, urging the US government to implement DMARC to "ensure hackers cannot send emails that… https://www.virusbulletin.com/blog/2017/07/dmarc-imperfect-solution-can-make-big-difference/

VB2015 paper: Mobile Banking Fraud via SMS in North America: Who's Doing it and How

Though SMS may have been claimed dead many time, it is still very much alive, and quite popular among mobile phishers. At VB2015, Adaptive Mobile researcher Cathal Mc Daid presented a paper various mobile phishing campaigns targeting North American banks.
While SMS has been declared dead many times, the service remains frequently used - and abused. In a paper presented at VB2015 in Prague, Adaptive Mobile researcher Cathal Mc… https://www.virusbulletin.com/blog/2016/03/vb2015-paper-mobile-banking-fraud-sms-north-america-whos-doing-it-and-how/

VB2015 video: Making a dent in Russian mobile banking phishing

Sebastian Porst explains what Google has done to protect users from phishing apps targeting Russian banks.
Sebastian Porst explains what Google has done to protect users from phishing apps targeting Russian banks. In the last few years, mobile malware has evolved from a mostly… https://www.virusbulletin.com/blog/2015/12/video-making-dent-russian-mobile-banking-phishing/

Facebook launches platform for sharing of threat intelligence

Twitter, Yahoo! amongst early participants in 'ThreatExchange'.
Twitter, Yahoo! amongst early participants in 'ThreatExchange'. When I took my first steps in the security industry, I was surprised by just how much information was shared between… https://www.virusbulletin.com/blog/2015/02/facebook-launches-platform-sharing-threat-intelligence/

VB2014 paper: DMARC - how to use it to improve your email reputation

Terry Zink presents case study in which he describes setting a DMARC policy for Microsoft.
Terry Zink presents case study in which he describes setting a DMARC policy for Microsoft.Over the next few months, we will be sharing VB2014 conference papers as well as video… https://www.virusbulletin.com/blog/2014/11/paper-dmarc-how-use-it-improve-your-email-reputation/

Yahoo's DMARC policy wreaks havoc among mailing lists

Collateral damage in instruction to reject emails with invalid DKIM signatures.
Collateral damage in instruction to reject emails with invalid DKIM signatures. A change in Yahoo's DMARC policy has caused frustration among operators of many mailing lists and… https://www.virusbulletin.com/blog/2014/04/yahoo-s-dmarc-policy-wreaks-havoc-among-mailing-lists/

Latest spam filter test shows spam catch rates have bounced back

Spam catch rates improve, but performance on phishing lags behind that on other spam.
Spam catch rates improve, but performance on phishing lags behind that on other spam. Earlier this week we published the results of the 22nd VBSpam comparative spam filter test,… https://www.virusbulletin.com/blog/2012/11/latest-spam-filter-test-shows-spam-catch-rates-have-bounced-back/

PayPal spam leads to exploit kit

Clicking on links leads to Blackhole rather than phishing site.
Clicking on links leads to Blackhole rather than phishing site. Fake PayPal receipts were being spammed out this morning, with links leading to a version of the Blackhole exploit… https://www.virusbulletin.com/blog/2012/05/paypal-spam-leads-exploit-kit/

Significant rise in malicious spam and phishing

Over one quarter of malicious emails contain eight-year-old malware.
Over one quarter of malicious emails contain eight-year-old malware. Email security firm eleven has reported a significant rise in both malicious emails and phishing emails in the… https://www.virusbulletin.com/blog/2012/04/significant-rise-malicious-spam-and-phishing/

Significant rise in Chinese phishing sites

Phishers shown to care little about domain names.
Phishers shown to care little about domain names. In its latest 'Global Phishing Survey', the Anti-Phishing Working Group (APWG) reports a significant increase in phishing sites… https://www.virusbulletin.com/blog/2011/11/significant-rise-chinese-phishing-sites/

'Meta-phish' uses attached form to evade web filters

Landing page contains clear warning.
Landing page contains clear warning. A phishing email targeting Austrian credit card users evades web filters by using an attached HTML form, but thankfully the landing page on the… https://www.virusbulletin.com/blog/2011/10/meta-phish-uses-attached-form-evade-web-filters/

Google AdWords phishing campaign spreads

Users urged to login because of 'issues'.
Users urged to login because of 'issues'. A new phishing campaign that targets users of Google AdWords looks worryingly real, GFI reports. The phish begins with an email claiming… https://www.virusbulletin.com/blog/2011/10/google-adwords-phishing-campaign-spreads/

« Previous 1234 Next »

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.