Hello world, Craigslist is being exploited as part of a new campaign by cybercriminals
to spread their malware. Craigslist - that’s a name I imagine you haven’t heard in a
while. I realise a good chunk of my audience is probably too young to know what Craigslist
even is. Hell, 40% of you guys aren’t old enough to have lived through the genesis of
memes, as per a recent Instagram poll - follow me by the way I’m @Jhonti.
Craigslist is like Facebook marketplace, people put their trash up for sale and you email
or call them directly, you can’t make payments through the site like you can with ebay. Craigslist
focuses on being very local, each city or area has its own subdomain and set of categories.
It was founded in 1995, and whilst at one point it may have been the goto website to
rid your basement of unwanted wares, it’s been dying a slow death. The site’s interface
doesn’t look like it’s changed much since its inception, the only thing that has changed
is how many people actually use it.
I spent some time browsing through craigslist whilst researching for this video, it felt
like a barren wasteland, full of weirdos. I stumbled across an ad for a free cat, his
name Jeff, they’re giving him away because he won’t stop jumping out of windows. Someone
else was selling what they describe as chocolate art, definitely going to have to censor this
one. Unwanted meat was also up for grabs.
Anyway, the malware campaign - it was uncovered by email security company Inky - and took
advantage of the way craigslist handles user messages. Craigslist allows users to send
emails to each other anonymously. To get in touch with another user you have to email
a randomly generated email address... and they have a similar looking email to contact
you. Craigslist uses an email relay system which acts as a conduit, forwarding the emails
to the true addresses. A bad actor harnessed this system to send hyper realistic phishing
emails to people who had posted Craigslist ads.
The emails claimed that the victim’s ad had been flagged for inappropriate content
and that a form would need to be filled out within 24 hours otherwise their account would
be terminated. The great thing - or not so great thing, about these emails is that they
come from a legitimate craigslist email address, so they are inherently believable… and despite
the email looking rather simple and not having some kind of fancy background like typical
notification emails from companies usually have…. Craigslist is known for their, minimalist
design, and so a basic looking email kinda fits in with their brand.
Inky explains “It appears as if bad actors were able to manipulate the email’s HTML
to create that button and link it to OneDrive.” However, this is where the mask slips, revealing
the email’s true intentions. Tapping the button takes you to a onedrive link, prompting
you to download a zip file, containing… and no surprises here, an excel document,
known to be malicious. I feel like half the hacks I talk about here on this channel feature
an infected spreadsheet using malicious macros, so I’m not going to bore you with a detailed
explanation on them, for that see my other video I’ll link below.
Though what I will say is this document is fairly well put together, opening the spreadsheet
gives you this page, telling you the doc is protected by “Docusign protect service”,
when in reality docusign has no such service. The English here is more than passable, and
their cover story of why you need to even enable macros is rather convincing… well,
to a layman. Of course running the macro will execute embedded malicious code.
Inky tested the spreadsheet in a malware sandbox, confirming the malicious intent of the doc,
if there was any doubt. As Inky explains “The malware also attempted to make external connections
to download more components or exfiltrate data, but these attempts received a “404
not found” error.”, “The error was likely due to a mistake on the part of the bad actors,
or it's possible that the malicious content was discovered on those hosts and had already
been taken down.”
Because of that 404 we don’t know the true intentions of this campaign, though it could
have been an attempted ransomware attack or bank logon stealer. This whole campaign is
quite clever and imo quite well executed. And I would imagine the average craigslist
user is a little… stuck in the past, a bit of a boomer when it comes to technology. So
I wouldn’t be surprised if this campaign had a relatively high success rate.
I’m curious, when was the last time you used craigslist, if ever? Am I just out of
touch, and is Craigslist in reality an oasis of opportunity, let me know in the comments.
Seytonic.com is now a thing! I’m uploading all my videos there along with a short written
article. There’s also a link to watch my content on the alternative video platform
library. You can also read about what I get up to when I’m not making youtube videos,
for instance the pentesting tools I sell through my company Maltronics.
If you enjoy this kind of video make sure to help me out by caressing the like button
for the youtube AI as well as turning on those sub notifications.
If you want to see what goes on behind the scenes make sure to follow me on the instagrams,
I’m @jhonti I will of course link it in the description.
And if you’re looking for something to watch next go check out my previous video on how
bad actors have been exploiting squid game to infect victims
As always sources will be linked in the video description, stay tuned for more hacking videos,
and have a good one.