Spammers Piggyback on Boston Marathon Attack
photo courtesy: usnews.nbcnews.com
Cybercriminals don’t hesitate when they see an opportunity to spread malware. Not even when it means exploiting as horrific an event as the Boston Marathon bombing.
There’s nothing new about this, of course. From big news events like Osama Bin Laden’s death, to lightweight showbiz stories — anything about Emma Watson, for example — cybercriminals are always on the lookout for credulous clickers.
Emails containing links that genuinely send traffic to video footage of yesterday’s bombing, are also geared to infect devices with a Trojan Horse. According to Sophos researchers, dangerous subject lines include:
- Aftermath to explosion at Boston Marathon
- Boston Explosion Caught on Video
- Video of Explosion at the Boston Marathon 2013
This is no small potatoes. The SANS Institute Internet Storm Center is reporting today that some 10 percent to 20 percent of all spam currently circulating is using Boston-related subject lines as hooks. Malicious URLs in the messages typically end with “boston.html” or “news.html.”
It’s all very well to describe this conduct as “sick” or “cruel,” but what’s really important is that we take a clear policy message from it. Consume breaking news via trusted websites; don’t click on unknown URLs in emails.
The temptation will be greater, of course, if the URL is spoofed to look like — and this is just an example — “cnn.boston.html.” That doesn’t seem to be happening with the examples I’ve seen.
Be alert, be smart, and don’t open the door to these sleazy exploits. More