Leveraging vulnerable website content management platforms, these attacks seek to trick users into installing malware under the guise that their web browser is out-of-date.
We all know that eventually your web browser will need to be updated. So, it’s not so out-of-the-ordinary for users to be notified that a newer version is available. Generally, this kind of notification utilizes the operating system’s normal update mechanisms. But, less savvy users may not be educated on how updates work, making this attack possible.
In essence, the user navigates to a site running on an older version of a content management system (CMS) such as WordPress, Drupal, etc. The “older” is an important caveat here, as these sites are more vulnerable to being compromised and leveraged by attackers.
The sophistication in this campaign is amazing! The initial malicious web page performs a ton of browser validation and then transparently navigates the victim’s browser to a malicious page that, in turn, redirects them to a browser update that looks like the one below:
Looks pretty legitimate to the untrained eye.
In addition, evasive techniques have also been seen to avoid detection by virtual sandbox technologies designed to spot these kinds of malicious web pages.
Users should be taught to ignore update notifications coming through their web browser, as this is only one of many attacks attempting to accomplish the same task. Users undergoing continual Security Awareness Training should already be aware of this tactic, and are savvy enough to both spot the potentially-malicious content and to avoid interacting with it.
KnowBe4 is the world’s most largest and popular integrated Security Awareness Training combined with Simulated Phishing attack platform, utilizing social engineering methods and strategies to conduct training. Founded in 2010, a US company located in Tama Bay, Florida with over 19,000 customers base across different sectors globally. Managing by CEO & employees of ex-antivirus experts and IT security Pros. KnowBe4 has been a winner of two consecutives Inc. 500 awards.