New Malware Can Do Just About Anything

A high-volume spam email campaign has been spotted running amok and it contains some dangerous malware. Recently, the malware HawkEye was found being sold on a publicly facing website and likely, that’s why it’s suddenly a popular tool for the bad actors. This one is capable of accomplishing many tasks to cause victims grief and the targets aren't limited to a specific industry, company size, or geographic location. It gets executed through phishing, of course.

HawkEye is typically associated with stealing login credentials, however it is very versatile. It can also:

• Steal email passwords
• Steal passwords from web browsers
• Take screen shots
• Log keystrokes (keylogger)
• Steal from crypto currency wallets

It usually arrives in inboxes with a subject line that is related to current events. The idea is to bait people into opening the message. Once it is opened, an attachment is inside in the form of a Microsoft Word file (.docx) with a believable name, such as “invoice” or “order confirmation.” If that is clicked, another document opens with an “error” message alerting the user that the document didn’t properly open or perhaps it was “downloaded from old browser.” Then there is an icon to be clicked that finishes the malware’s execution.

Remember to look for clues to phishing such as misspelled words or improper language use. If an email subject is related to a current news event, but the attachment inside is an “invoice,” it should also throw up a red flag.

Any attachment or link that arrives unexpectedly should be met with a healthy dose of suspicion too.

Phishing isn’t going away any time soon. That’s because it works amazingly well for the hackers. Taking a little time to make an informed decision on whether or not to click can make a lot of difference in keeping you and your organization safe from threats such as HawkEye.