The newest method of infecting computers is using a telephone call. Online researchers are documenting a new malware campaign they've dubbed "BazarCall." One of its primary malware "payloads" is the BazarLoader remote-access Trojan, which can give a hacker full control over your PC and be used to install more malware.
The attack starts with an email notifying that a free trial subscription for a medical service that users have supposedly signed up for is about to run out, and your credit card will be charged in a few days - at $90 a month or some other ridiculous rate.
The subject line may read "Thank you for using your free trial," "Do you want to extend your free period," or something similar, according to The Record and Bleeping Computer. A security researcher calling themselves "Execute Malware" has posted a list of possible BazarCall subject lines here.
Fortunately, the message provides a phone number you can call to cancel the subscription, plus a subscriber ID number that the user can refer to during the call. As the person call, they are placed on hold. They wait for a couple of minutes. And then a helpful call-center operator - he or she sounds suspiciously like someone who'd be part of a tech-support scam - comes on the line and listens to questions about the email. The operator asks for the subscriber ID mentioned in the email.
That subscriber ID is very important because it lets the crooks know who they are - and many of their targets are people who work in specific companies.
the customer-service rep puts you back on hold for a bit to check your subscriber ID, then comes back to tell you who signed up and provided a credit card for this subscription - and it's someone who's not you. There must be a mistake. The friendly customer-support person tells that because this concerns a medical service, users got to fill out some forms online to cancel the subscription. He sends them to a professional-looking website, where they can continue the cancellation process.
The rep directs users to the site's signup page, where they can click Unsubscribe. However, the Unsubscribe field doesn't ask for their name or their email address. Instead, it again asks for the subscription ID number found in the original email notification they received.
Click Submit on the Unsubscribe dialogue box, and your browser prompts you to allow download of a Microsoft Excel spreadsheet or Word document. The customer-support rep says you must download, open and digitally "sign" this document to cancel the subscription.
Now, Microsoft Office files downloaded from the internet are so dangerous that Windows itself "sandboxes" them so that they can't run macros - little mini-programs - without your permission.
But the customer-support rep on the phone insists that users click the yellow bar that appears across the top of this Excel or Word file to enable macros so that they can "sign" the document. And that's the kiss of death. As soon as they enable macros, the Office file installs a "dropper," a form of malware that reaches out to the internet and downloads and installs more malware.
In this case, the malware may be the aforementioned BazarLoader or the even more fearsome TrickBot. Once either of these is up and running on their machine, the crooks behind it can install coin miners, botnet software, or even ransomware on their device. If the machine is part of a company network, the malware will spread quickly throughout the company.
