• heeplr@feddit.de
    link
    fedilink
    English
    arrow-up
    5
    ·
    4 months ago

    articles don’t mention mitigation methods.

    what to disable in thunderbird to not be vulnerable to “obfuscated JavaScript file that is sent to the victim through emails in archive files.” and prevent that “The JavaScript file drops a self-copy at “C:\Users\<Username>” location with random names like “needlereportcreepy.bat”. The bat file is then executed”?

    • Telorand@reddthat.com
      link
      fedilink
      English
      arrow-up
      4
      ·
      4 months ago

      Best info I could find is from a previous blog post two links beyond the original article. “This updated version of malware delivered via JavaScript comes in archive files as attachments in emails.”

      So, don’t open any weird attachments…? That’s what I’m getting from it.

      • user134450@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        4
        ·
        4 months ago

        It could be using the HTML email renderer. Best to disable HTML view for emails unless its a know good source.
        View > Message Body As > Plain text

        • Telorand@reddthat.com
          link
          fedilink
          English
          arrow-up
          3
          ·
          4 months ago

          Could be. Unfortunately, the folks who found this don’t really go into enough detail about the attack’s initial entry point.