Fake Invoice Scam Worries Experts; Hacking Technique Proven Successful Even Without Malware Infection

A new fake invoice scam technique alarms cybersecurity experts.

First discovered by the Palo Alto Networks Unit 42, this malicious campaign is proven effective, even without malware infection.

Security researchers of the American multinational cybersecurity firm said the social engineering campaign is worryingly successful.

"By design, this style of social engineering attack leaves very few artifacts because of the use of legitimate trusted technology tools to carry out attacks," said the cybersecurity company via its official report.

Fake Invoice Scam Worries Experts

According to ZDNet's latest report, the attacks are connected to other similar campaigns that rely on phishing emails.

The Palo Alto Networks said the newly detected incidents were specifically linked to the so-called Silent Ransom Group callback phishing extortion campaign.

The cybersecurity organization added that the new malicious campaign could conduct extortions without encryption.

The recent phishing campaigns that the new fake invoice scam technique is related to commonly trick victims into installing the BazarLoader backdoor malware.

This malware can access the network to steal user data. Once that happens, hackers can blackmail victims into paying them to prevent information leakage.

But, the new malicious campaign no longer needs to install malware just to victimize companies, including those in the legal and retail industries.

The New Luna Moth Campaign

Palo Alto Networks' Unit 42 calls the new fake invoice campaign "Luna Moth." The cybersecurity group said that this malicious method skips the malware infection.

Despite the absence of malware downloads, the phishing scam is still proven effective.

As of writing, hackers behind the campaign already stole hundreds of thousands of dollars from legal firms, as well as retail and other business sectors.

It starts with hackers sending phishing emails to their victims. They will prevent sending a credit card invoice, complete with a PDF attachment.

Victims will only be asked to receive around $1,000. The Unit 42 group explained that the amount requested is lower than usual because it is less suspicious.

After that, victims will receive a call from fake call centers.

From there, they will be asked to install a remote administration tool, allowing hackers to gain remote access to their sensitive files and servers.

Aside from the latest Luna Moth campaign, the U.S. faces other potential security threats.

Previously, the U.S. government imposed a bipartisan warning against TikTok.

Cybersecurity experts also claim that hackers can access home security cameras.

For more news updates about Luna Moth and other cybersecurity threats, keep your tabs open here at TechTimes.

This article is owned by TechTimes

Written by Griffin Davis