Beware of Corrupted Email Attachments: A Growing Scam
Corrupted email attachments are a growing threat, especially for small businesses lacking dedicated security teams. A new phishing scam using corrupt attachments can deploy malware with just one click, leading to data breaches or ransomware attacks.
This article explains how these email attachment scams work, the risks they pose, and how to recognize and prevent them.
Protect your business by staying alert to this increasingly common cyberthreat.
How Corrupted Email Attachment Scams Work
Cybercriminals always modify malicious files to resemble valid files and consistently try to entice the user to click on the infected file. The email might contain corrupted attachments that resemble invoices, resumes, reports and/or harmless file names that might not immediately lead one think of corruption. In some cases, the email can have malware or code on the document or in the document that a user may open and it is important to note that only to attachments or embedded files that the malware/codes run in the moment the user opens it.
Cybercriminals exploit hundreds of under techniques to deceive users through email attachment(s), including social engineering trinkets such as a spoof email address, language/style, success language and any urgencies. Once the user has accessed, opened, or hovered the corrupt file, the corrupt corrupt file can potentially install ransomware, install a key logger, or give the assailant backdoors from a remote location.
In addition to the plain old email attachment scams, cybercriminals have begun to create new schemes so sophisticated, they can now go through the normal security filters.
Why Corrupted Attachments Bypass Security
Most attackers relish users’ associations with file formats (instances of Adobe Reader or word) to avoid their prevention tactics; user are repeatedly enticed or duped into opening their infected email. The attackers insert scripts or macros into what might otherwise look like a normal file enough so that again, users did not recognize it. Email security systems provides us something called signature (e.g., mostly its MD5 hash is used to distinguish the threat).
Email strikes at a real dilemma, because the known threat could be used with a different type of document that simply has a variant; while variants with signatures that have not yet been signatures can alsoigate easier methods as it relates to spam filter inputs . Many scammers simplified ways to remediate being detected (compressed file formats (zip)/password protected files), which is readily accessible, but are appealing to scan tools.
Scammers use an external reference link to malware files instead of putting the file type or format embedded in email communications, these tactics and techniques only increase the difficulty for spam filtering and anti-virus logic identifying the threat until it is too late.
Risks of Opening Corrupted Email Attachments
The risks associated with opening a corrupted attached file can lead to irreversible damage to your device. The majority of risk can lead to immediately installing ransomware, which is set to immediately and quickly retrieve files on your device and holding your files until ransom has been infiltrated.
Other attacks may silently log keystrokes and/or steal information in the background, which can expose credentials and financial information or lose business information.
In a business setting, one compromised device can lead to malware spread throughout the network, resulting in downtime, lost data, and compliance issues. The financial, reputational, or legal effects can be catastrophic, depending on the affected industry and data.
How to Protect Yourself and Your Business
Think Before You Click
Always confirm the identity of any sender and be suspicious of attachments that you were not expecting, or that request urgent attention. If there is anything that seems wrong with the email – even from a known contact, stop and double-check through another contact method.
Enable Multi-Factor Authentication
MFA provides an additional barrier of protection beyond the password layer of security. If your credentials were compromised due to opening a corrupted attachment, the attacker would still have limitations to logging in to your account – like a phone code or biometric capability that won’t be available.
Use Advanced Email Security Tools
Get a sophisticated email security platform that provides real-time threat identification, sandboxing, and behavioral analysis. These tools will review and analyze all attachments in a safe environment to find hidden malware before it lands in your email inbox.
Train Your Team Regularly
Phishing simulated scenarios and awareness training is an important part of facilitating individuals to identify suspicious emails and attachments. A knowledgeable team is your best defense against scams that rely on human errors.
What to Do If You Open a Corrupted Attachment
If you realize that you’ve opened a possible malicious attachment act quickly. Disconnect your device from a network like Wi-Fi, or mobile data to limit the spread of malware. Notify your IT or security team, and run a full malware scan using up-to-date antivirus software on your device.
Change any credentials that may have been compromised – especially for any sensitive accounts. If there are company documents involved or affected, pursue your incident response protocol, which may include legal notification process and required communication/reporting to affected clients.
Your quick action may limit the damage and reduce any future breaches.