Criminals target Apple

Yesterday an email received by several of our spam traps caught my eye:

The money mule recruiters are getting more cunning. Apple is a hot brand and a lot of people would like to work for it, so the criminals decided to claim that they are an Apple Premium Reseller looking for employees. The entire site is created to look like an Apple site.

They even went through the trouble of altering an image by adding their logo onto a store to make the site seem more legit:

But in the end the message remains the same as with any other money mule recruitment:

Money gathered via cybercrime, with bank trojans for instance, is transferred to the bank accounts belonging to the money mules.

Multiple large transactions to the same foreign bank account make the internal alarms at banks go off. This is why the criminals are recruiting regular people under false pretences to receive the money for them.

Reports on people falling for these recruiments are on the up, unfortunately. Unlike with phishing emails, people are actually aiding criminals and there can be serious legal and financial repercussions. When banks detect that somebody is muling the police will freeze or block the bank account and obviously won’t like the criminal activity either.

In this particular case, with the level of social engineering so superior to other money mule recruitments, I can only imagine that it will be highly effective.
And it’s able to work under Windows, Linux and OSX. 😉

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.