A new wave of cyber attacks has been operating in Israel in recent days

Attached to the message is a link to download a PDF file from a legitimate server of a file sharing platform. Since it is a recognized domain that is classified in many systems as white and pre-approved, it passes the corporate security filters and does not automatically trigger an alert. Within the PDI file itself, another link is integrated, which points to a phishing site impersonating the Google login page. The victim is asked to enter a username and password, and sometimes also a verification code. Once the details are typed, they are passed to the attacker.

After stealing the account information, the attacker enters the victim’s Google account and sometimes also other services connected to it. Using the stolen credentials, he connects to the Jumbo Mail platform and creates a new malicious link. In the final step, he returns to the hacked mailbox and sends the new link to the victim’s contacts. This creates a chain of infection where real users unknowingly become the distributors of the scam.

The company emphasizes that the Jumbo Mail servers themselves were not hacked and that the malicious messages are not sent from the company’s servers. The emails are distributed directly from hijacked private mailboxes, and the link points to a legitimate download page on the platform that contains the malicious file. It was also reported that users who activated two-step verification were protected against the hijacking of the account and its misuse.

The company recommends the public to take immediate steps. First and foremost, enable two-step verification on every email account. According to them, this is the main defense measure that prevents the attacker from using the hijacked account to continue spreading the fraud. It is also recommended to verify by telephone with the sender when a message of a legal or financial nature is received, especially if it includes an urgent demand for action.

In addition, it is recommended to use the preview option in the cloud before downloading files to the PC, to reduce the risk of running malicious files. Information security managers in organizations are offered to switch to managed corporate accounts, which enable centralized identity management and stricter security policy enforcement, with the aim of reducing information leaks and preventing misuse of hacked accounts.