Trojan Uses Legitimate Tools To Bypass Security Products

Cybersecurity research and analysis gets really tricky when the criminals start using legitimate tools to spread their banking Trojans and other malware. In a new phishing campaign being carried out in Brazil, a Trojan uses a legitimate VMware binary to deceive security tools and bypass security checks. Once it makes its way past, it allows malware to masquerade as a legitimate process to trick users out of banking credentials.

Users receive spam messages in Portuguese enticing them to open an invoice. The “invoice” is behind a shortened URL using goo.gl shortener. If the file behind the URL is clicked, malicious code installs the Trojan.

No matter how many perimeter security tools may be installed to protect a network, it will never completely eliminate risks of phishing attacks. While some can eliminate a significant amount of the threats, many still make it through to the end users’ mailboxes. It only takes one person to click a malicious link or attachment to set loose a Trojan that brings down the entire company.

Watch for the clues that an email may be phishing:

• Typos and grammatical errors
• Any links or attachments are not expected or are not explained in the message
• The sender is asking for information that seems suspect to you
• Any URLs included are shortened or direct to places that are unexpected or suspicious

If you do receive something that meets the above criteria, pick up the phone and call the sender to verify that he or she intended to send it. If it isn’t legitimate, just delete it.  It’s as easy as that to avoid this situation.

Just because this one is targeting Brazilians, doesn’t mean something similar won’t make it to the United States. Always be on the lookout for suspicious email messages.