Cybersecurity Gurus Raise Alarm over Hidden Malware Targeting Email Users

Cyber scams are evolving, don’t just sit back and watch. Take precautions.

As of this moment, cybersecurity experts are sounding alarms over sophisticated new hacking threats targeting email users worldwide. From malware embedded in innocent-looking images to advanced techniques that bypass two-factor authentication (2FA), the latest wave of attacks exposes vulnerabilities in even the most secure systems. Gmail, Outlook, and Microsoft 365 users are urged to stay vigilant against these ingenious schemes.

These threats include two malicious programs: VIP Keylogger, which records keystrokes and collects credentials, and 0bj3ctivityStealer, which steals account and credit card data. According to HP Wolf Security researchers, these malware campaigns ingeniously hide malicious code inside images hosted on legitimate websites, making them exceptionally hard to detect.

“By hiding malicious code in images,” researchers explained, “attackers bypass network security tools that rely on reputation checks.”  

Emails containing these threats often masquerade as invoices or purchase orders, tricking users into downloading seemingly harmless attachments. One malicious image was accessed over 29,000 times, while another campaign delivered malware via archived files disguised as quotation requests.

“The tactics demonstrate how threat actors are combining attack components to enhance efficiency,” said James Coker of Infosecurity Magazine.

2FA Bypass Attacks

Adding to the alarm, cybercriminals are now exploiting phishing-as-a-service kits to bypass 2FA protections. French cybersecurity company Sekoia recently uncovered a campaign leveraging a toolkit called Sneaky 2FA. This sophisticated kit harvests Microsoft 365 session cookies, allowing attackers to impersonate legitimate users without triggering additional verification. “These attackers create convincing fake login pages and use obfuscated code to avoid detection,” said Elad Luz, head of research at Oasis Security.

Another dangerous toolkit, FlowerStorm, has targeted Microsoft users by stealing login credentials and 2FA tokens in real time. It reroutes victims through phishing pages hosted on compromised domains, making it extremely difficult to identify the attack. Most targets are in the U.S. and Europe, with attackers using subscription services to sustain their operations.

Giants Fighting Back  

Tech giants like Google and Microsoft are stepping up their defenses. Gmail has deployed advanced AI models trained on phishing and malware patterns, blocking 20% more spam than before. Andy Wen, Gmail’s senior director of product management, highlighted new models that analyze hundreds of threat signals in real-time to enhance email security.

Microsoft, meanwhile, offers additional security layers for its Outlook.com users. Subscribers to Microsoft 365 receive advanced attachment and link screening automatically, aiming to protect against these increasingly sophisticated phishing threats.

How to Stay Safe

To combat these threats, experts emphasize the importance of adopting proactive cybersecurity measures. Patrick Tiquet of Keeper Security advises organizations to implement Privileged Access Management (PAM) to restrict account access and limit the damage caused by compromised credentials.

He also recommends using robust password managers, which can prevent users from entering login details on spoofed websites.

The Cyber Security Agency of Singapore (CSA) has also updated its list of recommended security apps for mobile devices. These apps, tested for malware detection, phishing detection, network threats, and device integrity checks, provide an extra layer of protection against email-based attacks. However, CSA cautions that no single tool offers absolute protection, urging users to remain vigilant and practice good cyber hygiene.

For users of Gmail, Outlook, and Microsoft 365, the battle against cyberattacks is ongoing. As new threats like VIP Keylogger, 0bj3ctivityStealer, and Sneaky 2FA emerge, staying informed and adopting robust security measures are the best defenses.

With vigilance and the right tools, individuals and organizations can stay one step ahead in the fight against cybercrime.