A phishing tale

I read about a case of computer fraud last weekend in an unlikely place: the parish bulletin of my local church. It seems that the priest’s name, and the postal address of the church, are being used in a way that is part 419 fraud, part identity theft and part phishing scam.

Unsolicited email is being sent from fake, though plausible, e-mail addresses. The email is apparently ‘signed’ by the priest and tells the recipients about a legacy they are about to receive, or asks for help in a financial transaction or simply asks for a donation.

The priest found out about it when someone in Australia decided to do some checking. He has reported the fraud to the police and the fake email accounts known so far (there may, of course, be others) have been closed down.

I’ll keep you posted about any developments.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.