Brazen crooks are now posing as cybersecurity companies to trick you into installing malware

Brazen cyber criminals are now posing as cybersecurity companies in phishing messages that claim the recipient has been hit by a cyberattack and that they should urgently respond in order to protect their network. 

But if the recipient does respond, they risk opening the door to hackers and could see their systems compromised with malware, ransomware and other dangerous cyber threats. 

The phishing campaign has been detailed by researchers at CrowdStrike, which is one of several cybersecurity companies being impersonated by cyber criminals to trick victims into calling a phoney helpline that then encourages the victim into supplying remote access to their network. CrowdStrike hasn't detailed the other cybersecurity companies that are being impersonated. 

SEE: A winning strategy for cybersecurity (ZDNet special report)

The message claims to be from "your company's outsourced data security services vendor" and suggests that "abnormal activity" and a "potential compromise" has been discovered on the network as part of a "daily network audit". 

It goes onto suggest that the cybersecurity provider is already dealing with the company's information security team, but that they've also been told to contact employees about their own machines and that it's "highly necessary" for the person receiving the email to respond to the message.  

The person receiving the email is provided with an incident case number and is told to call a particular phone number to organise the audit. The example detailed by CrowdStrike also features accurate branding. 

CrowdStrike describes this as "callback phishing" because when the victim calls the number, they're connected to an operator who'll try to persuade them to install remote administration tools (RATs) to gain access to the network.  

While the victim might believe a RAT – a tool used for legitimate purposes by many IT teams – is being installed to combat an infection, they're actually just unwittingly allowing a cyber criminal to gain initial access to the network for exploitation down the line.

"This is the first identified callback campaign impersonating cybersecurity entities and has higher potential success given the urgent nature of cyber breaches," CrowdStrike said in a blog post. 

Researchers haven't been able to identify what exactly the criminals behind this particular social-engineering and phishing campaign are doing, but they note that a similar campaign identified in March this year installed remote access software to provide lateral movement around networks and install malware. 

The likely end goal of the cyber criminals behind these phishing attacks is monetizing the access they've tricked victims into giving, potentially with ransomware attacks. Those attacks could be by the cyber criminals encrypting the network with ransomware themselves, or they could sell access to the infected network to ransomware groups. 

"CrowdStrike will never contact customers in this manner," the company said – and anyone who receives an email like this is urged to forward it to their cybersecurity provider to investigate. 

MORE ON CYBERSECURITY

• These are the biggest cybersecurity threats. Make sure you aren't ignoring them
• Ransomware: Why it's still a big threat, and where the gangs are going next
• This new malware is at the heart of the ransomware ecosystem
• These are the cybersecurity threats of tomorrow that you should be thinking about today
• Endless cyber-threat pressure could leave security staff burnt out. Here's what you need to change