Sophisticated spam attack targeting UK users looking for jobs and extra income
Compromised devices are used to act as proxies forwarding a malicious base64-encoded PHP script to vulnerable web servers in a new spam campaign active since May.
The compromised web servers in turn send an email, with link to the scam sites, to specific email addresses. Although currently used for directing the email recipients to scam news and cryptocurrency sites, by using a PHP shell the attackers could exploit the web server even after patching.
I am one of the editors here at www.systemtek.co.uk I am a UK based technology professional, with an interest in computer security and telecoms.