Zeus Sphinx Banking Trojan and Other COVID-19 Financial Relief Phishing Campaigns

Summary

After three years, the Zeus Sphinx banking trojan has resurfaced in coronavirus-themed phishing campaigns containing information on government relief payments. If the Microsoft Word password-protected attachment is opened and macros is enabled, the payload will be installed and used to harvest user credentials, authentication codes, and financial data via web injections. The threat actors are targeting major banks in the US, Canada, and Australia. Other social engineering lures around the COVID-19 financial relief have also been observed. 

Recommendations

The NJCCIC recommends users avoid clicking on links, opening attachments, or enabling macros delivered with unexpected or unsolicited emails, and exercise caution with emails from known contacts. Technical details can be found in the Bleeping Computer post and the Proofpoint post.