Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Bazar Call Method: Call Centers Help Spread Bazar Loader Malware

Summary: Unit 42 reported in early February 2021 that the BazarLoader operators were distributing the malware through call centers: emails with a trial-subscription theme tell recipients their credit card will be charged and give a phone number, and the operator who answers walks them to a fake unsubscribe site and through enabling macros in a downloaded Excel file. The macros drop a BazarLoader DLL that retrieves a BazarLoader EXE, which provides backdoor access to the Windows host; Unit 42 called the center at least five times, reached a different operator each time, and saw phone numbers change at least daily.

Key Takeaway: The infection completes only when an employee opens the attachment and clicks enable content while a live person talks them through it, so the control that stops BazarCall is a workforce that knows a phone call is not authorization to run a macro.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related