Zscaler Cloud Security Logo
Company > Blog

News and views from the leading voice in secure digital transformation

More From This Author

Profile picture for user cmannon@zscaler.com

Chris Mannon

Phishing activity
Insights and Research
7 Min read

Election 2020-themed scams and threat activities

The United States presidential election is here. And as COVID-19 still runs unchecked throughout the world, 2020 continues to be an outlier year in so many ways. But one thing remains constant—scammers and threat actors ...
A Big Day for Phishing
Insights and Research
4 Min read

A Big Day for Phishing

We hope you enjoyed your own Black Friday and found everything you wanted as you were shopping the sales. The threat actors certainly attempted to take advantage of the zeal of holiday shoppers. As a follow-up to our pre...
Scamming and Smishing while Shopping
Insights and Research
9 Min read

Scamming and Smishing while Shopping

A few weeks ago, the witches and skeletons that decorated shop windows for Halloween were swept aside and replaced with reindeer and jolly elves. Fir trees supplanted the pumpkins and “Jingle Bells” began drifting from s...
2019 NCAA Madness - Phishing and Streaming Scams
Insights and Research
5 Min read

2019 NCAA Madness - Phishing and Streaming Scams

Last week, 64 of the best men's college basketball teams (68 if you count the First Four games) began their quest to cut down the nets in Minneapolis on April 8. Since the opening day of the NCAA men's college basketball...
Black Friday & Cyber Monday Deals: Phishing and Site Skimmers
Insights and Research
4 Min read

Black Friday & Cyber Monday Deals: Phishing and Site Skimmers

It’s that time of year again! The most glorious of shopping seasons has arrived, and users have commenced their annual tradition of flooding e-stores in search of the best deals that their money can buy. Threat actors, k...
Black Friday Deals: Trojans, Phishing, and Crypto Coin Mining
Insights and Research
7 Min read

Black Friday Deals: Trojans, Phishing, and Crypto Coin Mining

Thanksgiving is once again upon us, followed by "Black Friday," which typically means one of two things: you will either be spending time with family as you recover from a food hangover, or you will be fighting the crowd...
Microsoft Office 0-Day leveraged in spam campaigns
Insights and Research
2 Min read

Microsoft Office 0-Day leveraged in spam campaigns

A new spam campaign has been leveraging exploits for the Microsoft Office vulnerability CVE-2017-0199. Security industry response to the vulnerability was rapid and several in-the-wild exploits have been detailed by vari...
Santa Claus is coming to town with a sack full of ransomware
Ransomware
4 Min read

Santa Claus is coming to town with a sack full of ransomware

It’s the season: holiday shopping has increased and email inboxes have been inundated with promotional emails, offers from online retailers, and discount banners. And with increased online shopping activity, you can expe...
Zika isn't the Only Thing You Need to Worry About During the Rio Olympics
Insights and Research
3 Min read

Zika isn't the Only Thing You Need to Worry About During the Rio Olympics

In just a few weeks, thousands of athletes and fans from around the world will gather in Rio de Janeiro for one of the world's most widely anticipated international sporting events, the Olympics. However, as one of the m...
Black Friday Deals On Malware & Scams
Insights and Research
5 Min read

Black Friday Deals On Malware & Scams

The holiday season means different things to a lot of people. For some, it’s a time for family and extravagant meals. For others, it’s a time for charity and giving more than your best to your partner. Yet for others sti...
Potentially Painful Programs Promising Pirated Products
Insights and Research
4 Min read

Potentially Painful Programs Promising Pirated Products

A major source of PC compromise doesn't come from targeted APT campaigns or Exploit Kits, but user's clicking things that they simply shouldn't. A common practice for adware and spyware writers is hosting large numbers o...
Magnitude Exploit Kit Leading To Ransomware Via Malvertising
Ransomware
5 Min read

Magnitude Exploit Kit Leading To Ransomware Via Malvertising

Magnitude Exploit Kit is a malicious exploit package that leverages a victim’s vulnerable browser plugins in order to download a malicious payload to a system. This technique is known as a drive-by-download attack,...
CryptoWall 3.0 Campaign Still Kicking
Insights and Research
3 Min read

CryptoWall 3.0 Campaign Still Kicking

A scary proposition for organizations and consumers alike is the possibility of being hit by a ransomware campaign. Ransomware threats have been known to spread through targeted spam campaigns, compromised WordPress site...
Malvertising Targeting European Transit Users
Insights and Research
6 Min read

Malvertising Targeting European Transit Users

Malvertising has been an active and growing attack vector for delivering malicious payloads to unsuspecting users. ThreatLabZ recently uncovered a malvertising campaign targeting European transit users and the end payloa...
Defaced Websites Leading To Dokta Chef Exploit Kit And CVE-2014-6332
Insights and Research
2 Min read

Defaced Websites Leading To Dokta Chef Exploit Kit And CVE-2014-6332

Defacing websites has been the main stay for hacktivist groups to spread their message. During recent research, we found multiple compromised websites containing a malicious link to a "lulz.htm" page, which in turn lead...
Crypto-Ransomware Running Rampant
Ransomware
3 Min read

Crypto-Ransomware Running Rampant

There's no doubt that ransomware is one of the most popular malware threats of 2014. Zscaler is not alone in this opinion, as other security firms have observed up to a 700% increase in infection rates to ransom-like mal...
Malvertising Campaign Leading To Zemot
Insights and Research
1 Min read

Malvertising Campaign Leading To Zemot

Malvertising has become a serious problem for advertisers and their clients alike. Times of Israel has been affected already by such an attack. During our analysis, we discovered multiple other legitimate websites...
Adware Utilizes Google Docs To Scam Users
Insights and Research
1 Min read

Adware Utilizes Google Docs To Scam Users

Spammers are no stranger to exploiting existing file-sharing services to propagate their warez and Google has been used in the past to bring some sense of legitimacy to a scam. In a scam that we recently uncovered, user...
USPS Spam Delivering Asprox Variant
Insights and Research
2 Min read

USPS Spam Delivering Asprox Variant

UPDATE: The botnet which is described here is called 'Asprox'. I've compared research with that seen from StopMalvertising. Recent email spam has begun taking advantage of user's need to snail mail something. The att...
Spearphishing Connects PCs To Russian Botnet
Insights and Research
3 Min read

Spearphishing Connects PCs To Russian Botnet

The talent over at MalwareBytes wrote this week about a Zbot dropper which comes from a PDF exploit through a spear-phishing e-mail. In their blog, they discuss how a spear-phishing attempts to exploit either CVE-2013-0...
Bitcoin Miner Utilizing IRC Worm
Insights and Research
2 Min read

Bitcoin Miner Utilizing IRC Worm

Bitcoin miners have given a new reason for attackers to communicate en mass with infected users. IRC worms are not exactly the most hip way to communicate, but they remain effective at sending and receiving commands. I...
Corporate Users Dive Into March Madness
Insights and Research
2 Min read

Corporate Users Dive Into March Madness

Here in the ThreatlabZ, we track stats and trends for all Zscaler customers. While our primary focus is on malicious traffic, it's intriguing to also track surges of traffic caused by non-security events. We weren't sur...
LightsOut EK Targets Energy Sector
Insights and Research
2 Min read

LightsOut EK Targets Energy Sector

Late last year, the story broke that threat actors were targeting the energy sector with Remote Access Tools and Intelligence gathering malware. It would seem that the attackers responsible for this threat are back for ...
New Asprox Variant Goes Above And Beyond To Hijack Victims
Insights and Research
2 Min read

New Asprox Variant Goes Above And Beyond To Hijack Victims

[UPDATE] After further analysis, this threat was identified as Asprox botnet and not Zbot Asprox is an extremely venomous threat, which has strong persistent tactics to ensure that the victim remains infected despite ...
Yahoo Ad Server Compromise Recap
Insights and Research
2 Min read

Yahoo Ad Server Compromise Recap

Malware writers had a big week to start off the new year by using Yahoo Advertisement services to peddle their warez. The talent over at Fox-IT broke the story last week which set Team Z on the hunt. The primary focu...
Bitcoin Mining Operation Seen Across Numerous Malware Families
Insights and Research
3 Min read

Bitcoin Mining Operation Seen Across Numerous Malware Families

The talent over at Malwarebytes broke a story this week regarding Fake Flash Player phishing attempts dropping malicious content onto victim machines for the purpose of mining Bitcoins. The threat tricks users into thin...
Google Docs Scam Stealing Passwords
Insights and Research
1 Min read

Google Docs Scam Stealing Passwords

Scammers are up to mischief again by tricking users into clicking false webmail widgets. The core goal of any phishing attempt is to compromise the victim's access to a particular service. Usually this is done by posin...
Sharik Back For More After Php.Net Compromise
Insights and Research
4 Min read

Sharik Back For More After Php.Net Compromise

Sharik is a Trojan which injects itself into legitimate processes and adds registry entries for an added level of persistence. The infection also sends information about the victim's PC to a remote server. The threat c...
NHIC Spam Harvesting Victim's Information
Insights and Research
1 Min read

NHIC Spam Harvesting Victim's Information

Scammers and spammers are known to capitalize on user's news hungry interests. In the past year, they've tricked users into clicking on malicious links in e-mails, blog comments and social media posts on anything from t...
A New Wave Of WIN32/CAPHAW Attacks - A ThreatLabZ Analysis
Insights and Research
8 Min read

A New Wave Of WIN32/CAPHAW Attacks - A ThreatLabZ Analysis

Introduction and setting the context Over the last month, the ThreatLabZ researchers have been actively monitoring a recent uptick in the numbers of Win32/Caphaw (henceforward known as Caphaw) infections that h...
Ransomware Posing As FBI
Ransomware
1 Min read

Ransomware Posing As FBI

Update: The Talent over at MalwareDon'tNeedCoffee has a very thorough analysis of this malware. Scammers and Spammers are always looking to cash in on recent news whether it be twerking or a royal baby. I know it ma...
Kelihos Botnet: What Victims Can Expect
Insights and Research
2 Min read

Kelihos Botnet: What Victims Can Expect

There is has been a recent surge in security blogs warning users to be extra cautious of a new spin on an old threat. Kelihos is a botnet which utilizes P2P communication to maintain its CnC Network. With all of the at...
CookieBomb Still Dropping Malicious Content
Insights and Research
4 Min read

CookieBomb Still Dropping Malicious Content

Cookiebomb is malicious obfuscated javascript injected into legitmate sites. We've talked on this blog about compromised sites before, but this one appears to still be fully functional and actively spreading malicious c...
Malware Using GoogleCode for Distribution
Insights and Research
2 Min read

Malware Using GoogleCode for Distribution

Malware hosting sites rarely stay up for too long. After the first few instances are seen by security vendors, they are added to denylists which, in turn, are fed into other denylists throughout the industry. Malware w...
Phishing For Ad Scams
Insights and Research
2 Min read

Phishing For Ad Scams

Today we have a perfect storm of basic attack vectors which inevitably lead victims to a variety of advertising scams including adware executables, parked domains, pay-per-click scams or phishing sites. First a small li...
FlimKit Coughs Up More Malvertising
Insights and Research
1 Min read

FlimKit Coughs Up More Malvertising

FlimKit is a known exploit kit which takes advantage of Java Vulnerabilities in order to drop malicious content on the victim's PC. Previous iterations of this Exploit Kit were known to be distributed through at least 1...
Facebook Scam For Stalkers
Insights and Research
1 Min read

Facebook Scam For Stalkers

If you are like me, you might feel bad about leaving your dog home alone all day while you are at work. So to alleviate his boredom, I've let him sign up for his own Facebook. Being new to the social media scene has al...
Popular Media Sites Involved In Mass Compromise
Insights and Research
2 Min read

Popular Media Sites Involved In Mass Compromise

Update (May 9): OSIRT had the opportunity to review the infected web app code for one of the compromised sites and has a great write-up to explain what was happening from a server-side vantage point. Today, Zscaler id...
Gone Phishin' On The Facebook
Insights and Research
3 Min read

Gone Phishin' On The Facebook

Social Media sites are rife for exploitation and malicious intent. They have become a staple of connectivity between colleagues, family, and friends to the point that they are in many cases the focal point of commu...
Door-to-Door Worm Cleaner
Insights and Research
2 Min read

Door-to-Door Worm Cleaner

Stop me if you’ve heard this one before. I’m telling a new acquaintance that I work in IT, particularly the security sector. “Neat…so my computer has been running slow recently…” I want to make a good impression...
Free Provider X90x.net Hosting Numerous Facebook Phishing Sites
Insights and Research
1 Min read

Free Provider X90x.net Hosting Numerous Facebook Phishing Sites

In the long history of free hosting and DNS providers abused (co.cc, pastehtml.com, etc.), x90x.net can now be added to the list, as it is being used to host many Facebook Phishing sites in a variety of languages: fa...
New Fake AV Page Uses Firefox Internals
Insights and Research
1 Min read

New Fake AV Page Uses Firefox Internals

Most Fake AV pages mimic a Windows Desktop application running. In addition, the Fake AV pages have generally been the same regardless of which browser they are viewed. I recently found a new type of Fake AV page that ...
Which Networks Are More Susceptible To Firesheep (aka Session Sniffing)?
Insights and Research
3 Min read

Which Networks Are More Susceptible To Firesheep (aka Session Sniffing)?

Firesheep highlighted once more, the problem of session sniffing. Users on open wireless networks are especially at risk when they login to websites without SSL encryption. But not all wireless networks are the same when...

Explore More Topics