Boston Marathon bombing being exploited by spammers
G Data is currently observing a huge wave of spam luring recipients to malware sites
Many people use the Internet as the first port of call for current news and background information, and videos are very popular with users when doing so. If an email recipient clicks on the link contained in the email, he will be taken to a primed site containing five different YouTube videos.
But besides the five films, the perpetrators have incorporated a Java applet on the website that has been primed to exploit a specific Java vulnerability on computers. If the Java variant installed on the computer is older than version 7 update 11, blackmail malware is installed on the computer with the aid of an exploit, and the infected PC is exploited to send more email.
In a second variant, the perpetrators also steal passwords that have been stored in the Firefox browser, e.g. for online shops, email inboxes or social networks, and read all unencrypted network traffic. This enables the criminals to spy closely on users.
Spam email with alleged video of the Boston bombing
G Data security tips for recipients of the spam emails
- Delete without opening: Spam email received should be deleted without being read. Email attachments or links in messages should not be clicked on for security reasons.
- Install security software: Users should install an effective security solution that includes virus protection, a spam filter, HTTP filter and real-time protection.
- Install updates: Users should always install all available patches and updates for the installed operating system and programs, to keep the PC fully up to date at all times.