Friday, March 29, 2024

Hackers Are Using MailChimp to Spread Malware

You probably know MailChimp either as an email newsletter service, or the company that seems to have adverts on every single podcast you’ve ever listened to. Hackers recently jumped on that popularity, and managed to send out emails containing malicious links to subscribers of various different companies.

The incident shows that hackers will likely use whatever distribution channels they can in an attempt to spread their malware and turn a profit.

Here’s your invoice! We appreciate your prompt payment,” one email sent by news site Business News Australia reads, and claims to be affiliated with accounting software Quickbooks.

Troy Hunt, an Australian security researcher and owner of breach notification site Have I Been Pwned?, sent Motherboard a copy of the email that he had received from a source. According to the email, it was sent by an administrator account at the news website.

The “View Invoice” button leads to a .zip file, which, according to scans on malware analysis site Virus Total, is malicious.

Companies and websites sometimes outsource their newsletter distribution to another company, to handle the infrastructure and headaches of firing out tens or hundreds of thousands of emails at a time. In this case, that was MailChimp, according to another apparent email from Business News Australia.

“This morning our MailChimp subscriber database was hacked and a fake invoice (Inoice 00317) [sic] was sent to our list,” the email reads, according to a screenshot tweeted by Hunt.

“Please disregard and delete this email. You have not been charged,” it adds. Camilla Jansen, managing editor of Business News Australia, told Motherboard in an email “We’re waiting to find out more.”

But it seems other companies have been affected too. One Twitter user uploaded an apparent screenshot of a near identical email sent to subscribers of the Sit Down Comedy Club in Brisbane’s mailing list.

Motherboard sent an email to The Sit Down Comedy Club, asking for comment, and immediately received the following, perhaps automated, reply.

“IF YOU RECEIVE AN EMAIL WITH THE TITLE – Inoice 00317 from Sit Down Comedy Club Pty Ltd – PLEASE DELETE the email you received, we do not use Quickbooks. It is SPAM and do not open it,” the email reads.

“We are trying to get to the bottom of this at the moment,” it adds.

Another Twitter user uploaded a screenshot of an apparent email from Jim’s Building Inspections, also an Australia-based company. The firm blamed the issue, without any evidence, on a “known cyber terrorist.”

MailChimp told Motherboard in a statement that “Early this morning MailChimp’s normal compliance processes identified and disabled a small number of individual accounts sending fake invoices. We have investigated the situation and have found no evidence that MailChimp has been breached. The affected accounts have been disabled, and fraudulent activity has stopped.”

The company would not say what the exact issue was, but MailChimp’s statement also strong encouraged users to setup two-factor authentication, implying that the problem might have been password reuse.

Update: This article has been updated to include MailChimp’s statement, which was sent to Motherboard after publication.

 
 
Website

Latest articles

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles