CYBER THREAT INTEL: Don’t Let Your Team Fall for the latest Copyright Infringement Scam

How the Campaign Works: Cyber criminals create dedicated Gmail accounts through which to distribute emails that impersonate legitimate companies – who ostensibly say that their intellectual property rights have been infringed upon. Roughly 70% of the impersonated companies are in the entertainment/media and technology space. The phishing messages themselves encourage individuals to take immediate action in order to remedy the situation. Recipients are instructed to download an archive file, which triggers the malware infection through DLL side-loading. The vulnerable binary then installs the latest version of the Rhadamanthys stealer (version 0.7), which includes new capabilities, such as an AI-powered optical character recognition (OCR) module.