I recently shared an article with information on the new LinkedIn phishing emails going around the internet. The article, “LinkedIn Phishing – Time for a Social Engineering Penetration Test?” contains detailed screenshots on how to identify such an email.
Now, only a short time later, the malicious email been unwrapped. Mickey Boodaei, Trusteer CEO, states:
“The fraudulent LinkedIn messages take users to a salesforceappi.com domain. Despite the name, the domain has nothing to do with Salesforce.com. It was registered May 31, and the server associated with the IP address is based in Russia.”
Once clicking the link, the user is brought to a website which downloads a ZeuS trojan to their computer. What is ZeuS malware you ask? ZeuS is a Trojan kit designed to generate a binary that installs a suite of data theft tools on a victim’s system. ZeuS is most often spread via drive-by downloads or phishing attacks. When infected, ZeuS has the ability for:
- Keystroke logging
- Taking screen shots to capture login data
- Modify web page content on-the-fly to hide
- Transmits collected data to the attacker’s servers
- Generate SPAM
In addition, ZeuS has the ability to bankrupt companies. This malware is no joke. Lastly, we have also blogged extensively on ZeuS. The articles can be found on our Techno Blog, Risky Business Blog and Simplified Blog.
So with that said, my advice is to look at emails before you click on a link.