DNSC warns of an attempted phishing attack and distribution of infostealer malware

The National Cyber Security Directorate (DNSC) has identified a new wave of attacks in the national cyberspace, in the recent period, more precisely an attempted phishing attack and distribution of an infostealer malware application, informs the cybersecurity institution.Attackers send an email with the subject line "Intellectual Property Infringement Warning", claiming to be from a law firm. In the body of the message, there is a short link that operates several redirects.The malware intervenes at the browser process level and extracts cookies, session tokens, and saved credentials, allowing unauthorized access to the user's online accounts. This data can then be leveraged to take control of e-commerce, email, financial platforms, or social media accounts, without requiring additional authentication.At set intervals or upon triggering certain actions, screenshots are taken and files, including legal documents, presentations, and databases, are collected. These materials are then sent to the attackers via the Telegram channel, giving them complete visibility into the victim's activities and confidential data.If the victim uses crypto wallet extensions, the malware identifies and exfiltrates private keys, giving attackers access to the user's digital funds, DNSC specialists say. At the same time, with the access gained, attackers can download and execute ransomware components, encrypting critical data and demanding a ransom for unlocking.DNSC recommends, among others: avoiding opening suspicious attachments such as .exe .bat .zip, .rar, .js files, etc. from unknown emails; using email security filters and blocking dangerous extensions; updating operating systems and applications; segmenting the network to limit the spread of attacks; monitoring network traffic and activating alerts in case of suspicious activities.At the same time, it is recommended to carry out specific training for employees to identify phishing e-mail messages, as well as to periodically make data backups and store them in a different environment, for the purpose of protection against ransomware attacks. (Photo:https://dnsc.ro/)