Subj : A massive new spam campaign is using some devious tricks includi To : All From : TechnologyDaily Date : Tue Feb 27 2024 12:45:06 A massive new spam campaign is using some devious tricks including spoofing some of the world's biggest brands Date: Tue, 27 Feb 2024 12:30:27 +0000 Description: That $1,000 prize didn't come from MSN - it's a fraud attempt. FULL STORY ====================================================================== Hackers have found a way to send spam emails that appear to hvae originated from trusted organizations, including some of the world's biggest brands, in a new campaign that has been described as massive. The messages themselves are what youd usually expect from a phishing email: a series of redirections generating revenue via fraudulent ads, fake giveaways, affiliate scams, and similar, according to Guardio Labs, which believes the campaign has been active since at least 2022. Some of the companies abused in this campaign include MSN, VMware, McAfee, The Economist, Cornell University, CBS, NYC.gov, PWC, Pearson, Better Business Bureau, Unicef, ACLU, Symantec, Java.net, Marvel, and eBay. Major campaign Every day of the campaign, some five million emails were being sent. The researchers cant determine exactly how much money was made through the campaign, but claim that its undoubtedly a lot. In total, more than 8,000 legitimate internet domains, as well as 13,000 subdomains have been abused in the campaign, which was later dubbed SubdoMailing. Guardio Labs recently analyzed one such email that seemed to have come from MSN, sent by a threat actor known as ResurrecAds. The threat actor scanned the internet for subdomains of reputable brands with CNAME records pointing to expired external domains, and once found, registered them via NameCheap. Once registered with NameCheap, the hackers hijack the domain and send spam and phishing emails. They have also hosted phishing pages and deceptive advertising which, on the victims side, would seem as if a reputable, trusted brand was sending the email. The hackers have also been scanning the internet for SPF records of target domains using the include: configuration option that pointed to defunct external domains, for the same results. With include:, the attackers were able to import allowed email senders from the external domain. Consequently, all of the emails would pass through security checks and land straight into peoples inboxes. Via BleepingComputer More from TechRadar Pro Best ransomware protection of 2024 Here's a list of the best firewalls around today These are the best endpoint security tools right now ====================================================================== Link to news story: https://www.techradar.com/pro/security/a-massive-new-spam-campaign-is-using-so me-devious-tricks-including-spoofing-some-of-the-worlds-biggest-brands --- Mystic BBS v1.12 A47 (Linux/64) * Origin: tqwNet Technology News (1337:1/100) .