www.securityweek.com Open in urlscan Pro
2606:4700:20::ac43:61a9  Public Scan

Form analysis
3 forms found in the DOM

GET https://www.securityweek.com/

<form method="get" id="zox-search-form" action="https://www.securityweek.com/" data-hs-cf-bound="true">
  <input type="text" name="s" id="zox-search-input" value="Search" onfocus="if (!window.__cfRLUnblockHandlers) return false; if (this.value == &quot;Search&quot;) { this.value = &quot;&quot;; }"
    onblur="if (!window.__cfRLUnblockHandlers) return false; if (this.value == &quot;Search&quot;) { this.value = &quot;&quot;; }">
  <input type="submit" id="zox-search-submit" value="Search">
</form>

Name: ccoptin — POST https://visitor.constantcontact.com/d.jsp

<form class="sw-newsletter-cc" style="" method="post" target="_blank" action="https://visitor.constantcontact.com/d.jsp" name="ccoptin" data-hs-cf-bound="true">
  <input type="hidden" value="1102592012458" name="m">
  <input type="hidden" value="oi" name="p">
  <div class="form-item">
    <input type="text" class="form-text required" value="" placeholder="Business Email Address..." size="60" name="ea" maxlength="128">
    <input type="submit" class="submit" value="Subscribe" name="go">
  </div>
</form>

Name: ccoptin — POST https://visitor.constantcontact.com/d.jsp

<form class="sw-newsletter-cc" style="" method="post" target="_blank" action="https://visitor.constantcontact.com/d.jsp" name="ccoptin" data-hs-cf-bound="true">
  <input type="hidden" value="1102592012458" name="m">
  <input type="hidden" value="oi" name="p">
  <div class="form-item">
    <input type="text" class="form-text required" value="" placeholder="Business Email Address..." size="60" name="ea" maxlength="128">
    <input type="submit" class="submit" value="Subscribe" name="go">
  </div>
</form>

Text Content

This website stores cookies on your computer. These cookies are used to improve
your website experience and provide more personalized services to you, both on
this website and through other media. To find out more about the cookies we use,
see our Privacy Policy.

We won't track your information when you visit our site. But in order to comply
with your preferences, we'll have to use just one tiny cookie so that you're not
asked to make this choice again.

Accept Decline


SECURITYWEEK NETWORK:

 * Cybersecurity News
 * Webcasts
 * Virtual Events


ICS:

 * ICS Cybersecurity Conference

 * Malware & Threats
   * Cyberwarfare
   * Cybercrime
   * Data Breaches
   * Fraud & Identity Theft
   * Nation-State
   * Ransomware
   * Vulnerabilities
 * Security Operations
   * Threat Intelligence
   * Incident Response
   * Tracking & Law Enforcement
 * Security Architecture
   * Application Security
   * Cloud Security
   * Endpoint Security
   * Identity & Access
   * IoT Security
   * Mobile & Wireless
   * Network Security
 * Risk Management
   * Cyber Insurance
   * Data Protection
   * Privacy & Compliance
   * Supply Chain Security
 * CISO Strategy
   * Cyber Insurance
   * CISO Conversations
   * CISO Forum
 * ICS/OT
   * Industrial Cybersecurity
   * ICS Cybersecurity Conference
 * Funding/M&A
   * Cybersecurity Funding
   * M&A Tracker

 * Cybersecurity News
 * Webcasts
 * Virtual Events

 * ICS Cybersecurity Conference

Connect with us
 * 
 * 
 * 

Hi, what are you looking for?





SECURITYWEEK

 * Malware & Threats
   * Cyberwarfare
   * Cybercrime
   * Data Breaches
   * Fraud & Identity Theft
   * Nation-State
   * Ransomware
   * Vulnerabilities
 * Security Operations
   * Threat Intelligence
   * Incident Response
   * Tracking & Law Enforcement
 * Security Architecture
   * Application Security
   * Cloud Security
   * Endpoint Security
   * Identity & Access
   * IoT Security
   * Mobile & Wireless
   * Network Security
 * Risk Management
   * Cyber Insurance
   * Data Protection
   * Privacy & Compliance
   * Supply Chain Security
 * CISO Strategy
   * Cyber Insurance
   * CISO Conversations
   * CISO Forum
 * ICS/OT
   * Industrial Cybersecurity
   * ICS Cybersecurity Conference
 * Funding/M&A
   * Cybersecurity Funding
   * M&A Tracker




CYBERCRIME


ENTERPRISES WARNED ABOUT ZIX-THEMED CREDENTIAL PHISHING ATTACKS

Enterprise users have been warned that cybercriminals may be trying to phish
their credentials by luring them with fake emails that appear to be related to
services offered by security company Zix.

By

Eduard Kovacs

September 28, 2021
   
   
 * 
   

 * Flipboard
   
   Reddit
   
   Whatsapp
   
   Whatsapp
   
   Email

Enterprise users have been warned that cybercriminals may be trying to phish
their credentials by luring them with fake emails that appear to be related to
services offered by security company Zix.

Zix provides cybersecurity, compliance and productivity solutions to 21,000
organizations, and cybercriminals have been leveraging the company’s reputation
in a phishing campaign aimed at enterprises.

Email security company Armorblox said on Tuesday that it has observed an attack
on customer environments across Microsoft Exchange, Office 365 and Google
Workspace.

“Although the potential account exposure of this attack campaign was close to
75,000 mailboxes, our threat research team found that a select group of
employees – usually across departments – were targeted within each customer
environment,” Armorblox explained in a blog post.

In the case of one organization, the emails targeted the CFO, the director of
marketing, the director of operations, and a professor. In another company, the
attacks targeted the president and the SVP of finance and operations.

“While the spread is seemingly randomized, attackers might also have
deliberately chosen their victims to be across departments and to contain a good
mix of senior leadership and individual contributors. These employees are
unlikely to communicate often with each other when they receive an email that
looks suspicious,” Armorblox said.

The fake emails are titled “Secure Zix message” and they instruct recipients to
click on a button within the email to read the “secure message.” Once the button
has been clicked, the victim is taken to a phishing page.

The fake emails do not appear to be exact copies of legitimate Zix
notifications, but they do borrow some design elements, enough to potentially
trick some unsuspecting users.

Advertisement. Scroll to continue reading.





In addition to abusing Zix’s name, the campaign leverages what appears to be a
domain belonging to a religious organization in the United States. Armorblox
noted that the malicious emails passed authentication mechanisms such as DMARC.

Armorblox said it was unable to obtain the final payload delivered in this
campaign, but the company believes it was most likely a phishing page for Zix or
other credentials. In many similar campaigns observed by Armorblox, the
attackers — impersonating various brands in the emails they sent out — were
attempting to lure victims to fake Office 365 login portals.

Zix-themed phishing messages have been making the rounds for months. In May, Zix
informed customers about a campaign that leveraged the compromised Microsoft 365
account of a US-based company. The compromised account had been used to send out
thousands of fake Zix emails, and a “small subset” of those emails reached Zix
customers.

Related: Microsoft: Ongoing, Expanding Campaign Bypassing Phishing Protections

Related: Coinbase Users Face Ongoing Phishing Attacks

Related: Chipotle’s Email Marketing Account Hacked to Spread Malware

Written By Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as
a high school IT teacher for two years before starting a career in journalism as
Softpedia’s security news reporter. Eduard holds a bachelor’s degree in
industrial informatics and a master’s degree in computer techniques applied in
electrical engineering.




MORE FROM EDUARD KOVACS

 * Man Sentenced to Prison for Stealing Millions in Cryptocurrency via SIM
   Swapping 
 * New York Sues Citibank Over Poor Data Security
 * Johnson Controls Ransomware Attack: Data Theft Confirmed, Cost Exceeds $27
   Million
 * Apple Patches Vision Pro Vulnerability as CISA Warns of iOS Flaw Exploitation
 * Tor Code Audit Finds 17 Vulnerabilities
 * US Sanctions Two ISIS-Affiliated ‘Cybersecurity Experts’
 * 45,000 Exposed Jenkins Instances Found Amid Reports of In-the-Wild
   Exploitation
 * US Disrupted Chinese Hacking Operation Aimed at Critical Infrastructure:
   Report 


LATEST NEWS

 * Watch: Top Cyber Officials Testify on China’s Cyber Threat to US
 * Man Sentenced to Prison for Stealing Millions in Cryptocurrency via SIM
   Swapping 
 * New York Sues Citibank Over Poor Data Security
 * At Least 30 Journalists, Lawyers and Activists Hacked With Pegasus in Jordan,
   Forensic Probe Finds
 * Johnson Controls Ransomware Attack: Data Theft Confirmed, Cost Exceeds $27
   Million
 * Why Are Cybersecurity Automation Projects Failing?
 * Apple Patches Vision Pro Vulnerability as CISA Warns of iOS Flaw Exploitation
 * US Says It Disrupted a China Cyber Threat, but Warns Hackers Could Still
   Wreak Havoc for Americans


Click to comment



TRENDING


MERCEDES SOURCE CODE EXPOSED BY LEAKED GITHUB TOKEN


SCHNEIDER ELECTRIC RESPONDING TO RANSOMWARE ATTACK, DATA BREACH 


IVANTI STRUGGLING TO HIT ZERO-DAY PATCH RELEASE SCHEDULE


CHATGPT VIOLATED EUROPEAN PRIVACY LAWS, ITALY TELLS CHATBOT MAKER OPENAI


AFTER DELAYS, IVANTI PATCHES ZERO-DAYS AND CONFIRMS NEW EXPLOIT


US DISRUPTED CHINESE HACKING OPERATION AIMED AT CRITICAL INFRASTRUCTURE: REPORT 


HOW TO ALIGN YOUR INCIDENT RESPONSE PRACTICES WITH THE NEW SEC DISCLOSURE RULES


TOR CODE AUDIT FINDS 17 VULNERABILITIES




DAILY BRIEFING NEWSLETTER

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest
threats, trends, and technology, along with insightful columns from industry
experts.




VIRTUAL EVENT: ATTACK SURFACE MANAGEMENT SUMMIT

February 15, 2024

Hear from leading cybersecurity experts as they explore the latest trends,
challenges and innovations in Attack Surface Management.

Register


VIRTUAL EVENT: SUPPLY CHAIN SECURITY SUMMIT

March 20, 2024

Join us for an in depth exploration of the critical nature of software and
vendor supply chain security issues with a focus on understanding how attacks
against identity infrastructure come with major cascading effects.

Register

EXPERT INSIGHTS


WHY ARE CYBERSECURITY AUTOMATION PROJECTS FAILING?

The cybersecurity industry has taken limited action to reduce cybersecurity
process friction, reduce mundane tasks and improve overall user experience.
(Marc Solomon)


HOW TO ALIGN YOUR INCIDENT RESPONSE PRACTICES WITH THE NEW SEC DISCLOSURE RULES

By turning incident response simulation into a continuous process and employing
innovative tools, you can address the stringent requirements of the new SEC
incident disclosure rules. (Torsten George)


IN THE CONTEXT OF CLOUD, SECURITY AND MOBILITY, IT’S TIME ORGANIZATIONS DITCH
LEGACY MPLS

If organizations understand the benefits SASE offers over MPLS and traditional
SD-WAN, they will realize that SASE is poised to replace aging MPLS in due time.
(Etay Maor)


OUTSMARTING RANSOMWARE’S NEW PLAYBOOK

Encryption is a technological necessity and also a legal safeguard, with
importance in both defending against and mitigating the consequences of
cyberattacks. (Rik Ferguson)


ACHIEVING “FRICTIONLESS DEFENSE” IN THE AGE OF HYBRID NETWORKS

A "frictionless defense” is about integrating security measures seamlessly into
the digital landscape to safeguard against threats while ensuring a positive
user experience. (Matt Wilson)

   
   
 * 
   

 * Flipboard
   
   Reddit
   
   Whatsapp
   
   Whatsapp
   
   Email

RELATED CONTENT


CYBERCRIME


CYBER INSIGHTS 2023 | RANSOMWARE

The changing nature of what we still generally call ransomware will continue
through 2023, driven by three primary conditions.

Kevin TownsendFebruary 2, 2023


CYBERCRIME


CYBER INSIGHTS 2023 | THE COMING OF WEB3

As it evolves, web3 will contain and increase all the security issues of web2 –
and perhaps add a few more.

Kevin TownsendFebruary 6, 2023


CYBERCRIME


COMODO FORUMS HACKED VIA RECENTLY DISCLOSED VBULLETIN VULNERABILITY

A recently disclosed vBulletin vulnerability, which had a zero-day status for
roughly two days last week, was exploited in a hacker attack targeting the...

Eduard KovacsOctober 1, 2019


CYBERCRIME


NEIMAN MARCUS SAYS HACKERS BREACHED CUSTOMER ACCOUNTS

Luxury retailer Neiman Marcus Group informed some customers last week that their
online accounts had been breached by hackers.

Eduard KovacsFebruary 2, 2016


CYBERCRIME


ZENDESK HACKED AFTER EMPLOYEES FALL FOR PHISHING ATTACK

Zendesk is informing customers about a data breach that started with an SMS
phishing campaign targeting the company’s employees.

Eduard KovacsJanuary 24, 2023


CYBERCRIME


DISH NETWORK SAYS OUTAGE CAUSED BY RANSOMWARE ATTACK

Satellite TV giant Dish Network confirmed that a recent outage was the result of
a cyberattack and admitted that data was stolen.

Eduard KovacsMarch 1, 2023


ARTIFICIAL INTELLIGENCE


MALICIOUS PROMPT ENGINEERING WITH CHATGPT

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of
AI for both good and bad.

Kevin TownsendJanuary 25, 2023


CYBERCRIME


MICROSOFT WARNS OF OFFICE ZERO-DAY ATTACKS, NO PATCH AVAILABLE

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code
execution attacks hitting its Office productivity suite.

Ryan NaraineJuly 11, 2023
 * 
 * 
 * 


POPULAR TOPICS

 * Cybersecurity News
 * Industrial Cybersecurity


SECURITY COMMUNITY

 * Virtual Cybersecurity Events
 * Webcast Library
 * CISO Forum
 * ICS Cybersecurity Conference
 * Cybersecurity Newsletters


STAY INTOUCH

 * Cyber Weapon Discussion Group
 * RSS Feed
 * Security Intelligence Group
 * Follow SecurityWeek on LinkedIn


ABOUT SECURITYWEEK

 * Advertising
 * Event Sponsorships
 * Writing Opportunities
 * Feedback/Contact Us


NEWS TIPS

Got a confidential news tip? We want to hear from you.

Submit Tip


ADVERTISING

Reach a large audience of enterprise cybersecurity professionals

Contact Us


DAILY BRIEFING NEWSLETTER

Subscribe to the SecurityWeek Daily Briefing and get the latest content
delivered to your inbox.


 * Privacy Policy

Copyright © 2024 SecurityWeek ®, a Wired Business Media Publication. All Rights
Reserved.












Close