Phishing Email Leads to Hancitor Malware

Heimdal Security researchers are reporting about a new phishing scam in the guise of fake Delta ticket confirmations.

Potential victims receive an email conformation about a Delta ticket that was confirmed via the victims credit card. There is no further information except a link to check the “status” of the flight.

You guessed it, the link takes you to a compromised site containing malicious word documents. The documents are loaded with Hancitor malware, which allows for further malicious malware downloads.

The emails do not have the address of "@delta.com" but rather “@deltaa”.

Source: SCMagazine