PayPal spam leads to exploit kit

Posted by   Virus Bulletin on   May 2, 2012

Clicking on links leads to Blackhole rather than phishing site.

Fake PayPal receipts were being spammed out this morning, with links leading to a version of the Blackhole exploit kit.

The emails look like typical PayPal confirmation emails and suggest that funds have been sent from the user's account. The supposed recipient of these funds varies between the emails, but they all share the surname 'Peterson'. Of course, the links in the email don't send the user to PayPal's website, but instead link to a landing page on a compromised website.

This landing page is an otherwise empty HTML page, where three pieces of JavaScript code are being loaded from three external websites. These three sites have been compromised as well, and each script contains the same piece of code that merely redirects the browser to another site. The use of three pieces of the same code means that the redirect will continue to work even if one or two of the sites are taken down or cleaned up.

The website the user is sent to appears to be run by the cybercriminals behind the attack themselves; it connects directly to the IP address and does not use a domain name. The page contains a piece of obfuscated JavaScript. De-obfuscating this code showed that this is, in fact, the infamous Blackhole exploit kit, which attempts to install malware on a user's machine via a number of known vulnerabilities in browser add-ons such as Flash and Java, as well as in the Windows operating system itself.

It may seem surprising that the criminals chose to send the user to an exploit kit, rather than to a phishing site. However, as many users are aware of phishing scams, even if they had clicked the link in the email, the domain name would be an obvious sign that something was not right. On the other hand, exploit kits silently infect the unprotected user which, via pay-per-install affiliate schemes, could generate money for those sending the spam.

Virus Bulletin has alerted the ISP that hosts the website running the exploit kit. At time of writing, the site is no longer accessible.

A technical paper on the Blackhole exploit kit, written by Sophos's Fraser Howard, can be found here.

iSIGHT's Ken Dunham and Shane Hartman will present a paper 'Blackhole exploit kit dominates the market' at VB2012 in Dallas (26-28 September). Registration for VB2012 is now open.

Posted on 2 May 2012 by Virus Bulletin

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

VB2019 paper: Fantastic Information and Where to Find it: A guidebook to open-source OT reconnaissance

A VB2019 paper by FireEye researcher Daniel Kapellmann Zafra explained how open source intelligence (OSINT) can be used to learn crucial details of the inner workings of many a system. Today we publish Daniel's paper and the recording of his…

VB2019 paper: Different ways to cook a crab: GandCrab Ransomware-as-a-Service (RaaS) analysed in depth

Though active for not much longer than a year, GandCrab had been one of the most successful ransomware operations. In a paper presented at VB2019 in London, McAfee researchers John Fokker and Alexandre Mundo looked at the malware code, its evolution…

VB2019 paper: Domestic Kitten: an Iranian surveillance program

At VB2019 in London, Check Point researchers Aseel Kayal and Lotem Finkelstein presented a paper detailing an Iranian operation they named 'Domestic Kitten' that used Android apps for targeted surveillance. Today we publish their paper and the video…

VB2019 video: Discretion in APT: recent APT attack on crypto exchange employees

At VB2019 in London, LINE's HeungSoo Kang explained how cryptocurrency exchanges had been attacked using Firefox zero-days. Today, we publish the video of his presentation.

VB2019 paper: DNS on fire

In a paper presented at VB2019, Cisco Talos researchers Warren Mercer and Paul Rascagneres looked at two recent attacks against DNS infrastructure: DNSpionage and Sea Turtle. Today we publish their paper and the recording of their presentation.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.