In the last few hours, at onBRANDING, we have detected and are working on the latest identified method of Malware injection into mobile devices via the calendar. The ultimate goal is to access the victim’s iCloud account. If successful, the victim may suffer from the disclosure of secrets, extortion, ransomware, reputational damage, etc.

How does it work?

A well-known Spanish actor has come to us after discovering that his email address has been subscribed to a calendar on his smartphone.

To subscribe the victim, cybercriminals need their email address. This may be public for various reasons:

• The user has published it on their social networks or website as a contact method.
• The social network where they are registered has been hacked, and therefore, their email address is public, along with those of other users.
• They have already been previously hacked and the criminals have their relational data.
• The cybercriminal is a direct contact of the victim.

Using the email address, the victim is subscribed to a calendar. Events are added to this calendar that appear as notifications on the victim’s smartphone.

The titles of these events usually generate fear or insecurity:

Each of these events contains a “solution” (proposed by the cybercriminal) via a link, where the victim “can solve” the problem:

The goal of the cybercriminals.

The cybercriminal’s aim is to obtain Apple ID data and access the victim’s iCloud account.

Most of the active URLs in the calendar events lead to the VPN application Jungle Protect:

IMPORTANT!

DO NOT DOWNLOAD THIS APPLICATION.

This is the malware through which we would open the door to cybercriminals.

How to act?

Above all, NEVER click on the links included in the events. If, on the contrary, the victim does open the link, do not download any application if requested; if access information or any other type of data is requested, do not provide it.

1. Solve the first problem: seek help and delete the calendar subscription.

If a user detects that they may be a victim of this cyberattack, they should:

• Notify onBRANDING immediately.
• Take screenshots of the calendar and the content of the events.
  DO NOT open the links.
• Once you have saved evidence that you are a victim, you must delete the calendar subscription:
  • Open the Calendar App.
  • Click on “Calendars.”
  • Find the calendar you have been subscribed to.
  • Delete it.

2. Solve the second problem: your email address is public.

If cybercriminals have been able to subscribe you to the calendar, it is because they have your email address. Most commonly, your email is public or has been made public without your consent.

To prevent possible cyberattacks via your email, you should:

• Change your password:
  • Use different passwords for each account and platform.
  • Do not use obvious passwords. Try to make it difficult for them!
• Activate Two-Factor Authentication (2FA): this way, no one can access your email account without you providing a second consent from your smartphone, even if the cybercriminal has your email account password.
• Create a new email address to be used ONLY for social networks: use a different password for each social network and activate 2FA.

Once your email is public, you can be a victim of numerous cyberattacks, such as unauthorized access to your iCloud account. Prevention is key, but knowing how to act can save us from many problems.

Eduardo Casanova will host a live session on his Instagram account together with onBRANDING to explain his experience with this type of cyberattack.

Protect your device.

What should you do to avoid being a victim of this type of cybercrime?

If you believe you are a victim of a malware injection attempt on your device, contact us. At onBRANDING, we can help you protect your devices, communications, and platforms. Furthermore, we specialize in the recovery of hacked accounts, recovery of hijacked or leaked information, and digital identity and reputation management.