A laptop with a bright white screen is in the background and a hand holiding a cell phone is in the foreground. On the cell phone screen is an envelope icon and a red alert above it.

Critical Malware Threat Targets Gmail and Outlook

Recently, a critical email threat targeting Gmail and Outlook users has come to light. Security researchers have identified malware campaigns distributing VIP Keylogger and 0bj3ctivityStealer threats, which can compromise these users. They are designed to steal personal identifiable information and other information by gathering keystrokes and taking screenshots.

HP Wolf Security is warning of a malware threat that hides inside images that are delivered to the inboxes of Gmail and Outlook users. Since many have an email account with one or both of these providers, everyone should stay alert.

The malware poses as typical items you’d see in your email: invoices, purchase orders and requests for quotations (RFQ). If these are activated, the malware is downloaded and set off to do its dirty deeds.

What can you do? As always, use good anti-phishing know-how:

  • Avoid opening attachments or clicking on links from unknown or unexpected sources, as they may contain malware.
  • Regularly update your operating system, email client and security software to patch vulnerabilities that could be exploited by malware.
  • Use complex passwords and avoid reusing them across multiple accounts to minimize the risk of credential theft.
  • Activate 2FA on your email and other critical accounts when it’s available. This adds an extra layer of security against unauthorized access.
  • Keep abreast of the latest security threats and best practices.

As for what the companies are doing, a spokesperson from Google said, “We developed several ground-breaking AI models that significantly strengthened Gmail cyber-defenses, including a new large language model that we trained on phishing, malware and spam.”

Microsoft has stated that “all Outlook.com users benefit from spam and malware filtering. For Microsoft 365 Family and Microsoft 365 Personal subscribers, Outlook.com performs extra screening of the attachments and links in messages you receive.” This should apply for all Microsoft 365 Family and Microsoft 365 Personal subscribers with email accounts ending in outlook.com, hotmail.com, live.com, and msn.com.

Bad actors are getting more creative and unfortunately this isn’t the only attack you need to be on the lookout for. Check out more of our cybersecurity and fraud prevention tips here.