Spam Uses Default Passwords to Hack Routers
Summary: Proofpoint detected a four-week spam campaign, sent to a small number of organizations and aimed mainly at Brazilian Internet users, that posed as Brazil's largest ISP warning of an unpaid bill and linked to a page mimicking the provider. That page ran a cross-site request forgery attack against known flaws in UT Starcom and TP-Link routers, then used hidden iframes to try default credentials and, on success, reset the router's DNS to the attacker's server with Google's 8.8.8.8 as secondary.
Key Takeaway: A single altered DNS setting lets an attacker redirect the victim to look-alike banking pages, and Proofpoint's Kevin Epstein notes there is virtually no trace of the attack except for an email, so it can sit undetected for long periods while bypassing antivirus and other security tools.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026