New “Paste and Run” Phishing Technique Makes CTRL-V A Cyber Attack Accomplice
A new phishing campaign tries to trick email recipients into pasting and executing malicious commands on their system that installs DarkGate malware.
Security researchers at Ahnlab have discovered a new phishing campaign that leverages a unique user interaction. Normally, phishing campaigns simply need users to open an HTML attachment.
But this campaign opens up a fake Word online page with an overlay dialog box asking users to navigate to the Windows Run dialog box, pasting the contents of the clipboard, and pressing Enter.
Source: Ahnlab
The HTML file loads a malicious PowerShell command into the computer’s clipboard and requires the user to help “deliver” to the OS.
The PowerShell command connects the victim’s computer to a web address that then downloads an HTA file.
What makes this method so strange is it seems almost impossible that anyone would fall for it. Start with the URL in the screenshot above – it’s a local C: drive file path. Then take the button name – “How to Fix.” It should at very least just say “Fix.”
And yet, we suspect, there will always be someone who doesn’t know any better who will simply do what they’re asked to do and… just like that Ctrl-V has become part of the cyber attack.
Users that undergo continual security awareness training will see right through such poor execution and protect the organization against phishing and social engineering attacks.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW