Cybercriminals Target Victims with Elaborate Phishing Scam Masquerading as Bank of America
A newly detected phishing scam is raising significant alarms in the cybersecurity landscape. This deceptive scheme involves cybercriminals sending fraudulent messages that appear to originate from Bank of America, with the intention of gaining remote control over unsuspecting victims’ devices. The threat was recently identified by cybersecurity firm Huntress, which has been meticulously analyzing various phishing techniques.
The nature of this scam is strikingly sophisticated. The phishing emails, which reached the Huntress honeytrap account on July 28, closely mimic the visual style, layout, and branding of Bank of America. This attention to detail extends from the initial email to the counterfeit website victims are led to when they click on the links provided. Such meticulous replication serves to enhance the credibility of the scam and increase the likelihood that victims will fall for the ruse.
Upon examination, the emails in question do not reference Bank of America’s authentic domain. Instead, they direct victims to the misleading domain of bkofamerica[.]com. The link contained within the email led to kleinschnitg[.]com, which subsequently redirected users to a page hosted on sectioncompil[.]com, where the malicious content ultimately originated.
The Huntress researchers made a critical observation regarding the tailored approach of the attack based on the type of device being used by the victim. For users operating Macs, the strategy diverged from the standard execution of malicious payloads. Rather than prompting Mac users to install software, they were instead enticed to submit valuable personal information, leaving them vulnerable to data theft.
In contrast, Windows users faced a more nefarious approach. When victims used a Windows browser, they were encouraged to download and install a program labeled “Account Guard.” The webpage presented Account Guard as a "powerful tool designed to protect your financial data, prevent unauthorized transactions, and safeguard against other cyber threats." This manipulative wording was intended to foster a false sense of security among users.
The installation process escalated when victims clicked the "Update My Information" button, which triggered the download of a ZIP file named AccountGuardSetup.zip. Within this file lay the Visual Basic Script (AccountGuardSetup.vbs). Executing this script led to the installation of ScreenConnect, a remote monitoring and management (RMM) tool, onto the victim’s system.
At this stage, the attacker could elevate privileges silently through a cleverly crafted C# script. This script exploits the ICMLuaUtil COM interface for a User Account Control (UAC) bypass, effectively granting the attacker control without alerting the victim. Each step in this intricate operation contains sizable Base64-encoded data blobs that, once decoded, unleash additional scripts, culminating in a PowerShell payload.
The final payload downloads a 17MB Base64-encoded installer from UploadToURL.com. This installer is decoded and written onto the victim’s system as a ScreenConnect MSI package. To enhance its stealth, the malware disguises ScreenConnect under the name "Windows Security," effectively masking its true identity. This tactic also includes purging installation traces, concealing related files and services via Windows permissions, and obstructing normal uninstallation processes.
After the successful installation of ScreenConnect, the malware establishes a connection to a command-and-control (C2) server at the IP address 217.60.195[.]167 over TCP port 8041. This particular IP address is situated in the United Arab Emirates and carries a dubious reputation, as it has been associated with multiple malware families that use this address for similar malicious activity.
In light of this alarming development, cybersecurity experts emphasize the importance of vigilance in protecting oneself against such attacks. Huntress advises users to carefully scrutinize the origins of emails and the destinations of hyperlinks. Awareness and caution can significantly reduce the chances of falling victim to these deceptive phishing schemes. It is crucial to remain informed about potential threats and adopt proactive measures to safeguard personal and financial information in the digital age.