Cyber ​​scam with Word documents as a Trojan horse: how it works and how to protect your personal and financial data

We are going to tell you about a new cyber scam campaign that They use Word as a Trojan horse. It is a type of attack that seems to be especially directed at professionals, especially freelancers, agencies, law firms, consultancies and other businesses.

It is a fairly sophisticated type of attack, and intelligently designed to bypass Word’s security measures. The objective is none other than to steal your financial data, and also some personal data. We will first tell you how it works so that you can identify it, and then we will give you some specific tips to avoid it.

How this scam works

The first step that cybercriminals take in this scam is to send you an email in which It looks like it was sent by a human resources or administration department. of a company. To do this, they will use terms related to these departments in the sender address and in the body of the email.

In this email they send, also will include matters related to payments, payroll or labor issuesmainly benefits. For example, they could be emails whose subjects say something like “Pending payments,” or “Annual bonuses for employees.” With this they try to get your attention. in the mail A Word file is attachedwhich apparently is normal.

The Word file is the key, because it is a corrupt .docx file. When you try to open it, Word will tell you that its content cannot be read and will offer to get it back.

When you tell it that you want to recover the file, the document will show a message with a QR code. This is the key part, because when you scan this code takes you to a fraudulent website which pretends to be the Microsoft login page.

The goal here is for you to give the scammers your login credentials for your Microsoft account, so they can access it. They will then be able to look at your account data, such as your emails or cloud storage, to look for sensitive banking details.

And the novelty of this attack is that corrupt docx file is not detected by antivirus or most of them, so it’s easier to fall in and think that everything that’s going on and the QR code is legit.

How to avoid this scam

The first thing you have to do to avoid this scam is don’t rush with emails. Read the sender carefully and how it is written, and if there is any suspicion in its wording that makes you think it is fraudulent, delete it. Also do the same when they are unknown senders.

Avoid scanning QR codes from unverified sources. These codes are often used for many types of scams, and although seeing it in a Word document may make you think it is legitimate, it really is not.

If you are a company or self-employed, try to invest time and money in cybersecurity training. The mechanisms of this type of scam are usually always phishing and the advice we have given you is usually applied to all similar ones, so it is important that all employees of a company know how to proceed and how to alert themselves.

Lastly, it is good to have your Microsoft account protected with two-step verification, so that if your email and password are stolen they cannot enter without knowing your verification code.

In Xataka Basics | False calls from the Civil Guard: how this scam works and how to avoid it