When Social Engineering meets Malware Injection
It’s not uncommon for cybercriminals to use a combination of several techniques to perpetuate their attacks. For instance, using social engineering techniques to infect victim’s devices with malware maximizes the chances of successfully injecting the malware. Through social engineering, such as phishing attacks, cybercriminals gain the trust and attention of their potential victims. Once they’ve managed to attract their attention, they are in a stronger position to convince the victim to let them inject whatever they want into the victims’ devices. Cyber criminals can easily gain victim’s sensitive information through a compromised device.
Malware and Social Engineering Go Hand in Hand
Advanced cybersecurity tools and techniques have come with an equally advanced, undetectable wave of malware attacks. Malware includes all sorts of malicious software such as viruses, trojans, spyware and ransomware, etc. Social engineers manipulate their victims into trusting them and handing them over confidential information like bank information or passwords. However, they can also trick unsuspecting users to install different kinds of malware that can either compromise user’s passwords and data or simply, handover the control of the victim’s device to the attacker while the victim remains completely unaware.
Phishing is the most common form of social engineering. Attackers use a phishing email, text message or even a website impersonating an authentic source to lure the victims into voluntarily giving away their details, clicking on an infected link or downloading some malware. While most of the users will be smart enough to ignore mail from an unknown user and not click on the download links from untrusted sources, they will not hesitate to follow directions coming from what appears to be a well-known, trusted source. It shouldn’t come as a surprise that social engineering techniques such as phishing emails are one of the most common methods of delivering malware to victim’s devices in order to gain access over sensitive data.
Some Common Malware Delivery Forms
Here are a few methods that have combined malware and social engineering to compromise personal or sensitive data:
1. Attachments Carrying Worms
A well-known example of such an attack is the Swen Worm which appeared to be coming from Microsoft. It contained an attachment that was supposedly a security patch to remove some vulnerabilities in the Microsoft Windows. The victims, believing that the email had come from Microsoft itself, downloaded the attachment which turned out to be a worm.
At some point, all of us have received an email that appears to be coming from a friend with attachments named like ‘Birthday Photos’ that may look harmless at first glance. Such phishing emails are used quite commonly for propagating worms. Organizations can protect their environments by creating awareness among their employees and encouraging them to have separate email accounts for work and leisure. An antivirus can scan attachments to ensure that they are secure. But most importantly, users should always make sure that the source is authentic, and if something appears to be amiss, it is better not to click on the attachment at all.
2. Malicious Links Downloading Malware
Attackers can spread malicious links through email, internet chat rooms and text messages that redirect to bogus websites. Through these websites, attackers can either collect sensitive data from their victims or simply release a malware into the system. Malicious links in phishing messages lead to fake websites that look similar to the original ones. Such messages may contain a time-sensitive warning or an alert that calls for quick action. The user can then be prompted to enter his/her credentials or download a hidden malware from the fraudulent website.
Just recently, Office 365 users were alerted of such scams where a phishing email that appears to come from the Office 365 admin takes victims to a fraudulent landing page that mimics Microsoft’s website and even uses a windows.net domain on Azure and Microsoft’s certificate. Another fake Office 365 website was discovered that alerted users of needing a browser update. Through the update link, attackers would conveniently launch a TrickBot malware.
Why Victims May Never Report?
Most of these delivery methods are designed to ensure that the victims do not report the problem to the security teams in time. For example, victims may be lured into downloading a software that claims to provide some sort of illegal benefits. Similarly, an email from a big firm announcing job vacancies can catch the interest of an organization’s employees, but they may be hesitant to admit that they were looking for job prospects in front of their employers.
Safety Tips
No matter how secure your organization’s network is, human error is inevitable. If your employees are not well-informed regarding the latest cyber attacks and security strategies, your organization will not stand a chance against the sophisticated cyber criminals of today. Employee awareness programs along with regular phishing assessments are your only bet against malware injection and social engineering. whether it’s injecting malware to access the victim’s sensitive data or using social engineering techniques to infect another device, social engineering and malware often go hand in hand. Employees must know how to protect themselves from both. In the end, employees are better off being overly cautious than becoming a victim to these advanced cyber attack strategies.
