Employees of US NGOs Fight for the Future and Free Press were targeted with complex spear-phishing attempts Attack.Phishing between July 7 and August 8 , reported today the Electronic Frontier Foundation ( EFF ) . Both organizations targeted in the attacks Attack.Phishing are currently fighting against for Net Neutrality in the US . Based on currently available evidence , the attacks appear to have been orchestrated by the same attacker , located in a UTC+3-5:30 timezone , said EFF Director of Cybersecurity Eva Galperin and EFF security researcher Cooper Quintin . At least one victim fell for the attacks `` Although this phishing campaign Attack.Phishing does not appear to have been carried out by a nation-state actor and does not involve malware , it serves as an important reminder that civil society is under attack , '' said the two today . `` It is important for all activists , including those working on digital civil liberties issues in the United States , to be aware that they may be targeted by persistent actors who are well-informed about their targets ’ personal and professional connections . '' At least one victim fell for the 70 fake emails sent Attack.Phishing during the phishing attempts Attack.Phishing . Attackers did n't deliver malware but lured Attack.Phishing victims away on a remote site designed to phish Google , Dropbox , and LinkedIn credentials . `` The attackers were remarkably persistent , switching up their attacks after each failed attempt and becoming increasingly creative with their targeting over time , '' EFF said . The most creative of the spear-phishing emails was when victims received Attack.Phishing emails with the subject line `` You have been successfully subscribed to Pornhub.com , '' or `` You have been successfully subscribed to Redtube.com , '' two very popular adult video portals . Minutes later , victims received Attack.Phishing another email made to look like Attack.Phishing it was coming from Attack.Phishing the same two services . These second emails contained explicit subject lines . Because spear-phishing emails were aimed Attack.Phishing at work emails , most victims would have been inclined to unsubscribe from the incoming emails . This was the catch , as attackers doctored the unsubscribe link , leading Attack.Phishing victims to a fake Google login screen . Attackers used different tactics as the campaign progressed The PornHub and RedTube phishes Attack.Phishing were not the only ones . Attackers also used other tactics . ⬭ Links to generic documents that asked users to enter credentials before viewing . ⬭ LinkedIn message notifications that tried to trick Attack.Phishing users into giving away LinkedIn creds . ⬭ Emails disguised to look like Attack.Phishing they were coming from Attack.Phishing family members , sharing photos , but which asked the victim to log in and give away credentials instead . ⬭ Fake email notifications for hateful comments posted on Attack.Phishing the target 's YouTube videos . When the victim followed the link included in the email , the target would have to enter Google credentials before performing the comment moderation actions . ⬭ Emails that looked like Attack.Phishing a friend was sharing Attack.Phishing interesting news stories . Used topics and subject lines include : - Net Neutrality Activists 'Rickroll ' FCC Chairman Ajit Pai - Porn star Jessica Drake claims Donald Trump offered her $ 10G , use of his private jet for sex - Reality show mom wants to hire a hooker for her autistic son In one case , one of the targeted activists received a request from a user asking for a link to buy her music . When the target replied , the attacker answered back Attack.Phishing with a Gmail phishing link , claiming the buy link did n't work . EFF experts say that victims who had two-factor authentication turned on for their accounts would have prevented attackers from logging into their profiles even if they had managed to obtain Attack.Databreach their password .

Bitcoin-seeking hackers are using old-school tricks to socially engineer would-be cryptocurrency exchange executives , researchers warn . An attack group tied to North Korea has `` launched a malicious spear-phishing campaign Attack.Phishing using the lure Attack.Phishing of a job opening for the CFO role at a European-based cryptocurrency company , '' researchers at Secureworks Counter Threat Unit warn in a report . The CTU researchers refer to the group behind the attack as `` Nickel Academy , '' although it is perhaps better known as the Lazarus Group ( see Kaspersky Links North Korean IP Address to Lazarus ) . The group has been tied to numerous attacks , including the attempted theft of nearly $ 1 billion from the central bank of Bangladesh 's New York Federal Reserve account , leading to $ 81 million being stolen ; the WannaCry ransomware outbreak Attack.Ransom in May ; as well as the use of cryptocurrency mining malware named Adylkuzz to attack the same flaw in Windows server block messaging that WannaCry also targeted ( see Cybercriminals Go Cryptocurrency Crazy : 9 Factors ) . Security researchers say Lazarus has also been running a series of job lure phishing attacks Attack.Phishing since at least 2016 , with the latest round being delivered around Oct. 25 of this year . The malicious code has `` solid technical linkages '' to attacks previously attributed to Lazarus , CTU says ( see Report : North Korea Seeks Bitcoins to Bypass Sanctions ) . Researchers at Israeli cybersecurity startup Intezer also believe the code has been reused by Lazarus , based on a review of attack code that 's been seen in the wild since 2014 . The fake job advertisement pretends to be Attack.Phishing for Luno , a bitcoin wallet software and cryptocurrency exchange based in London , according to an analysis of the phishing messages published Tuesday by Jay Rosenberg , a senior security researcher at Intezer . Luno says it 's been alerted to the fake emails bearing Attack.Phishing its name . `` We 're aware of this issue and are investigating thoroughly , '' Luno tells ISMG . If recipients of the latest CFO job lure Attack.Phishing phishing emails open an attached Microsoft Word document , it triggers Attack.Phishing a pop-up message inviting them to enable editing functions . The CTU researchers say this is an attempt to enable macros in Word , so that a malicious macro hidden inside the document can execute . If it does , the macro creates a decoy document - the fake CFO job lure - as well as installs a first-stage remote access Trojan RAT in the background . Once the RAT is running on the victim 's PC , attackers can use it to install additional malware onto the system , such as keystroke loggers and password stealers ( see Hello ! Can You Please Enable Macros ? ) . The CTU researchers say the job listing appears to have been stolen Attack.Databreach from a legitimate CFO job listing posted to LinkedIn by a cryptocurrency firm in Asia . While the researchers say that Lazarus has done this previously , unusually in this case , some typographical errors in the original listing were expunged . The researchers add that this phishing campaign Attack.Phishing does not appear to target any specific firm or individual , but rather to be more broadly aimed . `` There are common elements in the macro and in the first-stage RAT used in this campaign with former campaigns , '' the researchers write . The custom command-and-control network code that controls infected endpoints also includes components that were seen in previous attacks tied to Lazarus , they add .