The NJCCIC observed multiple phishing campaigns sent from both US and non-US top-level domains (TLD) to New Jersey State employees to deliver the AgentTesla malware, an advanced backdoor used to steal credentials and data. Read for tips to avoid this scam.
The NJCCIC received reports of targeted, well-crafted phishing emails claiming to be from financial institutions, specifically Citizens Bank. In the above example, the sender’s display name impersonates Citizens Bank to convey legitimacy. Click to learn more.
The NJCCIC observed phishing campaigns claiming to be from the Better Business Bureau (BBB) and targeting business owners in an attempt to deliver Ursnif data-stealing malware to potentially gain remote access, exfiltrate data, and deploy ransomware.
Emotet has resurfaced worldwide after three months of inactivity. Cofense researchers have discovered malicious email campaigns using finance and invoice lures to collect information for future campaigns, gain remote access, deploy ransomware, and exfiltrate data.
The NJCCIC observed websites containing SocGholish. SocGholish is a malware loader that exploits vulnerable website infrastructure and can perform reconnaissance and deploy malicious payloads, such as remote access trojans (RATs), information stealers, and ransomware.
