Email security, Vulnerability Management

New malware campaign uses James Webb telescope images

BleepingComputer reports that phishing emails and malware-laced space images from the James Webb telescope are being leveraged in the new 'GO#WEBBFUSCATOR' malware campaign involving Golang-based payloads. Attackers commence the infection with a phishing email with the malicious "Geos-Rates.docx" file that features an automatically executing obfuscated VBS macro that decodes a downloaded JPG image to a launchable executable, reported Securonix researchers. The report showed that opening the file in an image viewer displayed NASA's photo of the galaxy cluster SMACS 0723 but the same file opened in a text viewer displayed a Base64-encoded payload that could be converted into a malicious 64-bit executable. Researchers noted that the execution of the malware prompts the creation of a DNS connection to the command-and-control server for the delivery of encrypted queries. "In the case with GO#WEBBFUSCATOR, communication with the C2 server is implemented using `TXT-DNS` requests using `nslookup` requests to the attacker-controlled name server. All information is encoded using Base64," said Securonix.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.