Skip to content

At The Identity Organisation, we're here to help!

    Your privacy is important to us, and we want to communicate with you in a way which has your consent and which is in line with UK Law on data protection. As a result of a change in UK law on 25th May 2018, by providing us with your personal details you consent to us processing your data in line with current GDPR requirements.

    Here is where you can review our Privacy & GDPR Statement

    To remove consent at any time, please e-mail with the word "unsubscribe" as the subject.

    +44 (0) 1628 308038

    New “Paste and Run” Phishing Technique Makes CTRL-V A Cyber Attack Accomplice

    A new phishing campaign tries to trick email recipients into pasting and executing malicious commands on their system that installs DarkGate malware.

    Security researchers at Ahnlab have discovered a new phishing campaign that leverages a unique user interaction. Normally, phishing campaigns simply need users to open an HTML attachment.

    But this campaign opens up a fake Word online page with an overlay dialog box asking users to navigate to the  Windows Run dialog box, pasting the contents of the clipboard, and pressing Enter.


    Source: Ahnlab

    The HTML file loads a malicious PowerShell command into the computer’s clipboard and requires the user to help “deliver” to the OS.

    The PowerShell command connects the victim’s computer to a web address that then downloads an HTA file.

    What makes this method so strange is it seems almost impossible that anyone would fall for it. Start with the URL in the screenshot above – it’s a local C: drive file path. Then take the button name – “How to Fix.” It should at very least just say “Fix.” 

    And yet, we suspect, there will always be someone who doesn’t know any better who will simply do what they’re asked to do and… just like that Ctrl-V has become part of the cyber attack.

    Users that undergo continual security awareness training will see right through such poor execution and protect the organization against phishing and social engineering attacks.

    KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

    Free Phishing Security Test

    Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

    Here’s how it works:

    • Immediately start your test for up to 100 users (no need to talk to anyone)
    • Select from 20+ languages and customize the phishing test template based on your environment
    • Choose the landing page your users see after they click
    • Show users which red flags they missed, or a 404 page
    • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
    • See how your organization compares to others in your industry

    PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser:

    Sign Up to the TIO Intel Alerts!

    Back To Top