Enlarge (credit: Dodge This Security)

Criminal hackers have started using a novel malware attack that infects people when their mouse hovers over a link embedded in a malicious PowerPoint file.

The method—which was used in a recent spam campaign that attempted to install a bank-fraud backdoor alternately known as Zusy, OTLARD, and Gootkit—is notable because it didn't rely on macros, visual basic scripts, or JavaScript to deliver its payload. Those methods are so widely used that many people are able to recognize them before falling victim.

Instead, the delivery technique made use of the Windows PowerShell tool, which was invoked when targets hovered over a booby-trapped hyperlink embedded in the attached PowerPoint document. Targets using newer versions of Microsoft Office would by default first receive a warning, but those dialogues can be muted when users are tricked into turning off Protected View, a mode that doesn't work when documents are being printed or edited. Targets using older versions of Office that don't offer Protected View are even more vulnerable.

Read 4 remaining paragraphs | Comments

Cisco Elastic Services Controller CVE-2017-6688 Default Credentials Security Bypass Vulnerability
Apache HTTP Server CVE-2016-8740 Denial of Service Vulnerability
Red Hat Undertow CVE-2017-2670 Remote Denial of Service Vulnerability
FreeRADIUS TLS CVE-2017-9148 Authentication Bypass Vulnerability
ESA-2017-064: RSA Identity Governance and Lifecycle Multiple Vulnerabilities
[security bulletin] HPESBUX03747 rev.1 - HP-UX running BIND, Remote Denial of Service
Internet Storm Center Infocon Status