Chinese hackers trying new trick with legit websites

https://www.theverge.com/2020/10/17/21520799/google-chinese-hackers-biden-campaign-mcafee-malware

Sample quote

The group, which Google refers to as APT 31 (short for Advanced Persistent Threat), would email links to users which would download malware hosted on GitHub, allowing the attacker to upload and download files and execute commands. Since the group used services like GitHub and Dropbox to carry out the attacks, it made it more difficult to track them.

“Every malicious piece of this attack was hosted on legitimate services,
making it harder for defenders to rely on network signals for detection,”
the head of Google’s Threat Analysis Group Shane Huntley wrote in the blog post.

End quote

That's why I use AVG and not McAfee or Norton and download from the original source.

The other nice one is they are getting into mail servers and acting as agents for sales of everything from heavy equipment to home closings. Sending wire instructions to a new account and poof.... gone... when the money is wired.

If the wiring instructions for your transaction are changed midstream, get on the phone with the bank, sales people, whoever to verify with a real person and NEVER trust any email is my suggestion.

Careful saying anything against China here... You might get spanked for being "political."

Might be best in the current events forum.

might be the russians

My wife works for a real estate attorney. They and their bank will not transfer money without a voice confirmation from the bank/lawyers in charge of the transaction for this very reason.
At least a couple of his clients have already been stung by this scam when they used other attorneys.

How is a voice confirmation anymore valid? Being there are more Chinese that speak English, then Americans.

The people at the bank know the lawyers and they have prearranged clerks to handle the transfers. No transfers can be done without the specific clerk that handles that account talking to specific people at the law firm. Nothings fool proof but so far so good for them. They also always have to talk to the parties involved and never go by emailed instructions alone. That is where the scams come in. Emails get sent that involve the original people with but with fake wiring instructions. How the scammers know who is involved and what person's emails are involved I don't know but it happens a lot.