Hackers can now sneak malware into the GIFs you share
Hackers can now sneak malware into the GIFs you share Digital Trends
Hackers can now sneak malware into the GIFs you share
September 9, 2022 Share to your computer was the most nefarious method hackers have produced, but there’s a new, even lower type of attack that uses Microsoft Teams and GIFs to mount phishing attacks on your computer. The new attack is called GIFShell and it installs malware on your computer to steal data. It does so by sneaking itself into innocent-looking GIFs and then waiting for you to share the GIF with your colleagues via. The problem was discovered by cybersecurity expert , who shared his findings exclusively with . This new GIF attack exploits multiple vulnerabilities in Microsoft Teams to create a chain of command executions. The only thing the attackers need is a way to get into Microsoft Teams in the first place, and they have settled on one of everyone’s favorite web items: GIFs. The attacks include malicious code in base64 encoded GIFs. They then use Microsoft’s own web infrastructure to unpack the commands and install them directly on your computer. Microsoft Teams is fairly secure and has multiple levels of protection against malicious file sharing. However, GIFs are usually benign, and people love sharing them. They’re the perfect conduit for attacks. The files can spoof your computer into opening Windows programs such as Excel. It can then send data back to its originator by tricking Windows into connecting to a remote server. Rauch disclosed his findings to Microsoft in May 2022, but the company has yet to fix the flaws. Microsoft told Bleeping Computers the GIF attacks “do not meet the bar for an urgent security fix.” The best thing you can do for now is to not open any GIFs someone may share with you . We’ll keep an eye on this story and let you know when, and if, Microsoft gets around to fixing the vulnerability.