[BreachExchange] Hackers Are Using MailChimp to Spread Malware

[Destry Winant]

https://motherboard.vice.com/en_us/article/53dqnz/hackers-are-using-mailchimp-to-spread-malware

It’s not yet clear whether the MailChimp customer’s re-used a
compromised password, or whether the issue is on MailChimp’s side.

You probably know MailChimp either as an email newsletter service, or
the company that seems to have adverts on every single podcast you've
ever listened to. Hackers recently jumped on that popularity, and
managed to send out emails containing malicious links to subscribers
of various different companies.

The incident shows that hackers will likely use whatever distribution
channels they can in an attempt to spread their malware and turn a
profit.

"Here's your invoice! We appreciate your prompt payment," one email
sent by news site Business News Australia reads, and claims to be
affiliated with accounting software Quickbooks.

Troy Hunt, an Australian security researcher and owner of breach
notification site Have I Been Pwned?, sent Motherboard a copy of the
email that he had received from a source. According to the email, it
was sent by an administrator account at the news website.

The "View Invoice" button leads to a .zip file, which, according to
scans on malware analysis site Virus Total, is malicious.

Companies and websites sometimes outsource their newsletter
distribution to another company, to handle the infrastructure and
headaches of firing out tens or hundreds of thousands of emails at a
time. In this case, that was MailChimp, according to another apparent
email from Business News Australia.

"This morning our MailChimp subscriber database was hacked and a fake
invoice (Inoice 00317) [sic] was sent to our list," the email reads,
according to a screenshot tweeted by Hunt.

"Please disregard and delete this email. You have not been charged,"
it adds. Camilla Jansen, managing editor of Business News Australia,
told Motherboard in an email "We're waiting to find out more."

But it seems other companies have been affected too. One Twitter user
uploaded an apparent screenshot of a near identical email sent to
subscribers of the Sit Down Comedy Club in Brisbane's mailing list.

Motherboard sent an email to The Sit Down Comedy Club, asking for
comment, and immediately received the following, perhaps automated,
reply.

"IF YOU RECEIVE AN EMAIL WITH THE TITLE - Inoice 00317 from Sit Down
Comedy Club Pty Ltd - PLEASE DELETE the email you received, we do not
use Quickbooks. It is SPAM and do not open it," the email reads.

"We are trying to get to the bottom of this at the moment," it adds.

Another Twitter user uploaded a screenshot of an apparent email from
Jim's Building Inspections, also an Australia-based company. The firm
blamed the issue, without any evidence, on a "known cyber terrorist."

MailChimp told Motherboard in a statement that "Early this morning
MailChimp's normal compliance processes identified and disabled a
small number of individual accounts sending fake invoices. We have
investigated the situation and have found no evidence that MailChimp
has been breached. The affected accounts have been disabled, and
fraudulent activity has stopped."

The company would not say what the exact issue was, but MailChimp's
statement also strong encouraged users to setup two-factor
authentication, implying that the problem might have been password
reuse.