FlagThis - #emailsecurity

Cybercriminals are increasingly leveraging Scalable Vector Graphics (SVG) files in phishing attacks to circumvent traditional email security measures. Sophos researchers have uncovered this rising threat, noting that attackers use SVG files to distribute malicious links leading to credential theft. These SVG files, commonly used for vector-based images, can contain hyperlinks and scripts within their text-based XML instructions, enabling attackers to embed malicious content directly within the graphics file.

Attackers often employ social engineering tactics in phishing emails, impersonating well-known brands like DocuSign, Microsoft SharePoint, Dropbox, and Google Voice to trick recipients into opening the malicious SVG attachments. When a user clicks the embedded link, they are redirected to a credential-harvesting site disguised as a legitimate login portal. Sophos has observed increasingly sophisticated SVG phishing attacks, including the use of Cloudflare CAPTCHA gates, credential pre-filling, live phishing templates, and JavaScript auto-redirects to further evade detection.


References :

• securityonline.info: Sophos Uncovers Rising Threat of SVG-Based Phishing Attacks
• ciso2ciso.com: Cybercriminals Weaponize Graphics Files in Phishing Attacks – Source: www.infosecurity-magazine.com
• ciso2ciso.com: Ciso2Ciso - Cybercriminals Weaponize Graphics Files in Phishing Attacks

Classification:

• HashTags: #PhishingAttacks #SVGFiles #EmailSecurity
• Company: Sophos
• Target: Email Users
• Attacker: Sophos
• Product: SVG
• Feature: Scalable Vector Graphics
• Type: Phishing
• Severity: Medium

The US Government's Office of Personnel Management (OPM) is facing a lawsuit over the hasty implementation of a new federal email system. Two anonymous employees have filed a complaint in a Washington DC district court, alleging that the rapid rollout, spearheaded by the Trump administration, violated the E-Government Act of 2002. The complaint claims that the OPM established a single email address, HR@opm.gov, intended for direct communication with all civilian federal employees, bypassing the usual procedures where OPM works with agencies and departments. This centralized system has raised concerns, with some speculating its primary use might be to facilitate mass firings.

At the center of the controversy is a lone, on-premises server allegedly set up quickly on the OPM network to handle the central email inbox. Crucially, a privacy impact assessment, mandated by law, was not completed or published before deployment. This assessment is meant to ensure that any staff data on the machine is protected. The lawsuit claims this oversight was intentional and willful, drawing parallels to a significant 2014 cyberattack where 20 million records were stolen from the same OPM. The agency's handling of this new system, especially given its history, has raised eyebrows and fueled fears of another potential cyber disaster.


References :

• ciso2ciso.com: The curious story of Uncle Sam’s HR dept, a hastily set up email server, and fears of another cyber disaster – Source: go.theregister.com
• go.theregister.com: The curious story of Uncle Sam's HR dept, a hastily set up email server, and fears of another cyber disaster
• Pyrzout :vm:: The curious story of Uncle Sam’s HR dept, a hastily set up email server, and fears of another cyber disaster – Source: go.theregister.com
• The Register: The curious story of Uncle Sam's HR dept, a hastily set up email server, and fears of another cyber disaster Lawsuit challenges effort to create federal-wide centralized inbox expected to be used for mass firings
• Pyrzout :vm:: The curious story of Uncle Sam's HR dept, a hastily set up email server, and fears of another cyber disaster

Classification:

• HashTags: #cybersecurity #usgovernment #emailsecurity
• Company: US Government
• Target: US Government
• Product: email server
• Feature: email server
• Type: Vulnerability
• Severity: Major