Beware of encrypted PDFs as latest trick to deliver malware to you
Russian-backed hackers are using malware disguised as a PDF encryption tool to steal your information. According to the Threat Analysis Group report, Coldriver will send victims encrypted PDFs.
When the unsuspecting victim replies saying they can't see the PDF, the group will send a download link that poses as an encryption tool. But it's really malware.
According to Threat Analysis Group (TAG), which is a specialized team within Google that focuses on identifying and countering various security threats, Coldriver primarily deals with phishing attacks. So this new malware-based attack is relatively new territory for the group.
The attack itself is pretty simple. As previously mentioned, attackers will send an encrypted PDF and then a malware-loaded "encryption tool" once the victims respond. That "encryption tool" will even display a fake PDF document to really sell the ruse. However, it's really backdooring a piece of malware called Spica into your device.
RUSSIAN MALWARE COMPROMISES ENERGY DEPARTMENT, OTHER FEDERAL AGENCIES
Spica will steal cookies from Google Chrome, FireFox, Edge and Opera in order to get your information. Google says it's been in play since September 2023. However, there are instances of Coldriver dating back to 2022.
Google says it's added all domains, websites and files involved in the attacks to its Safe Browsing service. The company has also notified targeted users that they were at risk of an attack.
MORE: HOW CRYPTO IMPOSTERS ARE USING CALENDLY TO INFECT MACS WITH MALWARE
1. Don’t download bootleg software: It’s not worth the risk to download bootleg software. It exposes your device to potential security threats, such as viruses and spyware. If someone emails you a link for a download, make sure it's from a reputable source and scan it. Downloading software from reputable app stores is definitely the way to go to protect your devices.
2. Don’t click on suspicious links or files: If you encounter a link that looks suspicious, misspelled, or unfamiliar, avoid clicking on it. Instead, consider going directly to the company’s website by manually typing in the web address or searching for it in a trusted search engine. Most often, the first or second result that comes up is legitimate. If you see the word "Sponsored "above the search result, take a beat before clicking it and consider clicking on the result below it.
3. Update your device with software regularly: Regularly updating your device’s software is crucial for security because it ensures that you receive the latest patches, bug fixes, and security enhancements. These updates help protect your device from vulnerabilities and potential threats that could be exploited by malicious actors.
4. Have good antivirus software: The best way to protect yourself from clicking malicious links that install malware that may get access to your private information is to have antivirus protection installed on all your devices. This can also alert you of any phishing emails or ransomware scams. Get my picks for the best 2024 antivirus protection winners for your Mac, Windows, Android & iOS devices.
MORE: HOW HACKERS ARE EXPLOITING WINDOWS SMARTSCREEN VULNERABILITY TO SPREAD MALWARE
If it has already happened, and you’ve been hacked, then you should take immediate action to minimize the damage and secure your device. Here are some steps that you can follow:
If hackers have recorded your passwords, they could access your online accounts and steal your data or money. On another device (i.e., your laptop or desktop), you should change your passwords for all your important accounts, such as email, banking, social media, etc. You want to do this on another device so the hacker isn’t’ recording you setting up your new password on your hacked device. And you should also use strong and unique passwords that are hard to guess or crack. You can also use a password manager to generate and store your passwords securely.
You’ll want to activate two-factor authentication for an extra layer of security.
You should check your online accounts and transactions regularly for any suspicious or unauthorized activity. If you notice anything unusual, report it to the service provider or the authorities as soon as possible. You should also review your credit reports and scores to see if there are any signs of identity theft or fraud.
Identity Theft protection companies can monitor personal information like your home title, Social Security Number (SSN), phone number, and email address and alert you if it is being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals. See my tips and best picks on how to protect yourself from identity theft.
GET FOX BUSINESS ON THE GO BY CLICKING HERE
If hackers have obtained your bank or credit card information, they could use it to make purchases or withdrawals without your consent. You should contact your bank and credit card companies and inform them of the situation. They can help you freeze or cancel your cards, dispute any fraudulent charges, and issue new cards for you.
If hackers have accessed your email or social media accounts, they could use them to send spam or phishing messages to your contacts. They could also impersonate you and ask for money or personal information. You should alert your contacts and warn them not to open or respond to any messages from you that seem suspicious or unusual.
MORE: STEALTHY BACKDOOR MAC MALWARE THAT CAN WIPE OUT YOUR FILES
Hackers will also look for ways to get into your device. It's your job to make sure you stay on top of your security and browse the web safely. That includes being cautious of what you're downloading. Even if you receive a file from a trusted contact, you should do your due diligence.
Are you worried about more attacks from groups like Coldriver? How do you protect yourself? Let us know by writing us at Cyberguy.com/Contact.
For more of my tech tips & security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.
Ask Kurt a question or let us know what stories you'd like us to cover.
Answers to the most asked CyberGuy questions:
Copyright 2024 CyberGuy.com. All rights reserved.