Our advisories highlight current cyber security threats and vulnerabilities in New Zealand, and provide guidance on how to mitigate their impact.
Subscribe to our updates above to be notified as soon as we publish an advisory.
TLP Rating: White
A phishing campaign containing malware is targeting business banking customers of some New Zealand banks.
The phishing emails are branded to look like invoice notifications from accounting software systems. Once a user clicks on the attachments or links in the email, malware is downloaded onto the user’s machine.
The phishing emails may have been sent up to three months ago.
The phishing emails appear to be invoice notifications. They use accounting software brands and have links to download an invoice.
The malware infects the browser and adds malicious plugins. These plugins are used to steal login credentials, as well as two-factor authentication codes. Attackers are using these stolen credentials to access the bank account and transfer money to overseas accounts.
The security of the accounting software and the banks is not affected by this campaign.
If you are a business banking customer of a New Zealand bank, keep an eye out for unexpected emails from common accounting software companies.
Below is an example of the phishing email:
CERT NZ has been working with MYOB and affected parties about this issue.
You can tell if your business is affected if:
Some anti-malware or system scans are not identifying the malware, so if you believe you’ve been affected and your anti-virus is not detecting anything, CERT NZ still strongly recommends taking these mitigation steps.
Banks will notify their business customers if they know you’re affected.
To prevent this malware from being installed, CERT NZ recommends not opening or downloading any invoices that are unexpected or appear illegitimate.
The emails are using familiar accounting software brands. If you’re unsure if an email is legitimate, contact the company that sent the invoice to confirm, using a different method.
If you’ve been affected by this campaign, you’ll need to secure your online accounts, and clean the infected machines.
For online security, CERT NZ recommends:
To clean your affected machines of this malware, CERT NZ recommends:
If you are affected, report to CERT NZ
For media queries, email our media desk at media@mbie.govt.nz or call the MBIE media team on 027 442 2141.