Google URLs are being used to disguise malware sent through contact forms - TechRadar

New campaign uses social engineering to deliver the IcedID malware.

Cybercriminals have begun leveraging website contact forms to deliver malware and the IcedID banking trojan to unsuspecting enterprise employees over email according to new research from Microsoft.

If a targeted employee decides to investigate the contents of one of the campaign's emails further and click on the site.google.com link, the page automatically downloads a ZIP file which contains a JavaScript file that downloads the IcedID malware as a .DAT file.

“While this specific campaign delivers the IcedID malware, the delivery method can be used to distribute a wide range of other malware, which can in turn introduce other threats to the enterprise.

IcedID itself is a banking trojan that has evolved to become an entry point for more sophisticated threats, including human-operated ransomware.

As this new campaign is capable of delivering a wide range of malware, employees should be on the lookout for any suspicious emails claiming they violated copyright.