{"id":8531,"date":"2017-02-13T12:30:51","date_gmt":"2017-02-13T20:30:51","guid":{"rendered":"http:\/\/blog.hellotech.com\/?p=8531"},"modified":"2021-06-13T11:19:08","modified_gmt":"2021-06-13T18:19:08","slug":"javascript-spread-malware","status":"publish","type":"post","link":"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware","title":{"rendered":"Attackers Now Use \u201cHarmless\u201d File Types, Like JavaScript, to Spread Malware"},"content":{"rendered":"\n

You probably already know that .EXE and .DLL files can contain malware and that you shouldn\u2019t download these file types if you\u2019re not sure of where they come from. What you probably don\u2019t know, though, is that your computer can also get infected by relatively innocuous objects like images and JavaScript attachments.<\/p>\n\n\n\n

\"Attackers<\/span><\/figure><\/div>\n\n\n\n

Online security experts have discovered that attackers have gotten smarter and are now using file types that don\u2019t arouse suspicion. Through this technique, they have been able to distribute various types of malware such as Locky (a kind of ransomware)<\/a> and Kovter (a click-fraud Trojan).<\/p>\n\n\n\n

JavaScript and Danger<\/h2>\n\n\n\n

One such \u201charmless\u201d file is JavaScript. This programming language is used to display web-based content (along with CSS and HTML), and it\u2019s even utilized in non-web based environments like desktop widgets and PDF documents. JavaScript has become a normal part of internet life that most people don\u2019t bat an eye when they encounter it \u2014 a fact that has been taken advantage of by many attackers.<\/p>\n\n\n\n

The Microsoft Malware Protection Center reported in April 2016 that several spam campaigns have used JavaScript email attachments<\/a> (which appear as .JS files) to distribute malware. In many of these cases, JavaScript acted as a downloader: when the email recipient clicked on a .JS file, it downloaded the malware and installed it on the recipient\u2019s computer.<\/p>\n\n\n\n

However, there have also been instances when JavaScript was used not just to download malicious software but also to write them. Malware are traditionally written in C and C++ but RAA, a type of ransomware, is special since it\u2019s written in JavaScript. It takes advantage of the fact that many Windows computers automatically execute .JS files through the built-in Windows Script Host program. When RAA infects a computer, it locks the users\u2019 files (including word documents, spreadsheets, and images) and prevents them from accessing these files until they pay the ransom.<\/p>\n\n\n\n

It\u2019s Not Just JavaScript<\/h2>\n\n\n\n

JavaScript is not the only innocuous file type that\u2019s used to attack unsuspecting people. Just this month, the Microsoft Malware Protection Center reported that cyber criminals are now using .LNK files to distribute viruses and other malicious software through email. LNK is the file extension used for shortcuts that lead to executable files; the desktop shortcuts for Google Chrome and Mozilla Firefox, for example, are both .LNK files.<\/p>\n\n\n\n

\"Attackers<\/span>
Harmful scripts are everywhere online so one must be careful always.<\/figcaption><\/figure><\/div>\n\n\n\n

As reported by the Microsoft Malware Protection Center, attackers take .LNK files, infect them with harmful scripts, put them inside .ZIP files, and distribute them through email. When recipients open the shortcut file, it executes a PowerShell script that attempts to download Locky and Kovter from five or even more domains. The script is written in such a way that it could get around URL filtering programs employed by a user\u2019s computer or email client, and the use of multiple domains increases its chances of successfully installing malware.<\/p>\n\n\n\n

Aside from .LNK files, some cybercriminals use .SVG files<\/a> in their activities. SVG (which stands for Scalable Vector Graphics) is the file extension used for two-dimensional images, and .SVG files are considered harmless. But what many people don\u2019t know is that they can contain JavaScript which, in turn, can be used to download malicious programs. Online security experts have reported that this technique has been used to spread the Locky ransomware through Facebook Messenger.<\/p>\n\n\n\n

Protecting Your Computer<\/h2>\n\n\n\n
\"Attackers<\/span><\/figure><\/div>\n\n\n\n

So, what should you do to protect yourself from these files? Well, you can start by reviewing your PowerShell execution settings and choosing the \u201cRestricted\u201d option, which prevents the program from automatically executing files. However, it\u2019s important to note that this isn\u2019t a foolproof plan since attackers have figured out how to sidestep these restrictions and \u201cforce\u201d PowerShell to run malicious programs.<\/p>\n\n\n\n

Another thing you can do is to switch to Gmail if you\u2019re not using it yet. Google announced last month that Gmail will no longer support JavaScript attachments<\/a> starting February 13. The .JS file is now one of the many file types \u2014 31, to be exact \u2014 that Gmail has blocked. If you really need to send a JavaScript file to someone, you\u2019ll be required to upload it to Google Drive or any other cloud storage service; you can then share the link to friends or coworkers once the file has been uploaded.<\/p>\n\n\n\n

If you\u2019re using a Windows 10 PC, you\u2019ll want to enable Windows Defender. This inspects files at runtime and can detect malicious scripts even before they\u2019re put into action, preventing the download and installation of ransomware and other harmful programs.<\/p>\n\n\n\n

Of course, one of the easiest and most effective steps is to be careful when you\u2019re online. Avoid opening emails from people you don\u2019t know, and don\u2019t click on a JavaScript or .SVG file if you\u2019re not expecting to receive one. And remember: .JS, .SVG, and .LNK are not the only file types that can be exploited by cyber criminals. So, if you receive an email or a Facebook message containing a file type you don\u2019t recognize, it\u2019s best not to open it.<\/p>\n","protected":false},"excerpt":{"rendered":"

You probably already know that .EXE and .DLL files can contain malware and that you shouldn\u2019t download these file types if you\u2019re not sure of where they come from. What you probably don\u2019t know, though, is that your computer can also get infected by relatively innocuous objects like images and JavaScript attachments. Online security experts have discovered that attackers have gotten smarter and are now using file types that don\u2019t arouse suspicion. Through this technique, they have been able to […]<\/p>\n","protected":false},"author":1,"featured_media":8563,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[17587,17593],"tags":[],"class_list":["post-8531","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","category-staying-safe"],"acf":[],"yoast_head":"\nAttackers Now Use \u201cHarmless\u201d File Types, Like JavaScript, to Spread Malware - The Plug - HelloTech<\/title>\n<meta name=\"description\" content=\"Your computer can get infected by relatively innocent files like images and JavaScript attachments. Be careful before downloading anything!\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Attackers Now Use \u201cHarmless\u201d File Types, Like JavaScript, to Spread Malware - The Plug - HelloTech\" \/>\n<meta property=\"og:description\" content=\"You probably already know that .EXE and .DLL files can contain malware and that you shouldn\u2019t download these file types if you\u2019re not sure of where they\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware\" \/>\n<meta property=\"og:site_name\" content=\"The Plug - HelloTech\" \/>\n<meta property=\"article:publisher\" content=\"http:\/\/www.facebook.com\/hellotech\" \/>\n<meta property=\"article:published_time\" content=\"2017-02-13T20:30:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-06-13T18:19:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2017\/02\/laptop-1146825_640-min.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"640\" \/>\n\t<meta property=\"og:image:height\" content=\"426\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@HelloTech\" \/>\n<meta name=\"twitter:site\" content=\"@HelloTech\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/dec00225dd888a509740ace5e4d9de6c\"},\"headline\":\"Attackers Now Use \u201cHarmless\u201d File Types, Like JavaScript, to Spread Malware\",\"datePublished\":\"2017-02-13T20:30:51+00:00\",\"dateModified\":\"2021-06-13T18:19:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware\"},\"wordCount\":869,\"publisher\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/#organization\"},\"articleSection\":[\"News\",\"Staying Safe\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware\",\"url\":\"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware\",\"name\":\"Attackers Now Use \u201cHarmless\u201d File Types, Like JavaScript, to Spread Malware - The Plug - HelloTech\",\"isPartOf\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/#website\"},\"datePublished\":\"2017-02-13T20:30:51+00:00\",\"dateModified\":\"2021-06-13T18:19:08+00:00\",\"description\":\"Your computer can get infected by relatively innocent files like images and JavaScript attachments. Be careful before downloading anything!\",\"breadcrumb\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.hellotech.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Attackers Now Use \u201cHarmless\u201d File Types, Like JavaScript, to Spread Malware\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#website\",\"url\":\"https:\/\/www.hellotech.com\/blog\/\",\"name\":\"The Plug - HelloTech\",\"description\":\"Turn to The Plug for informative tech news that you can use. \",\"publisher\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.hellotech.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#organization\",\"name\":\"HelloTech\",\"url\":\"https:\/\/www.hellotech.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2018\/11\/HT-logo-revised-final.png\",\"contentUrl\":\"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2018\/11\/HT-logo-revised-final.png\",\"width\":1000,\"height\":174,\"caption\":\"HelloTech\"},\"image\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"http:\/\/www.facebook.com\/hellotech\",\"https:\/\/twitter.com\/HelloTech\",\"http:\/\/www.instagram.com\/hello_tech\",\"https:\/\/www.youtube.com\/channel\/UCIR-fbAKRfVuAbciDr2z4nQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/dec00225dd888a509740ace5e4d9de6c\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/cbb537d18df244ad7d57a3639d94ede5cd90bf1fb742392af5731beaf11ffeb1?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/cbb537d18df244ad7d57a3639d94ede5cd90bf1fb742392af5731beaf11ffeb1?s=96&d=mm&r=g\",\"caption\":\"admin\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Attackers Now Use \u201cHarmless\u201d File Types, Like JavaScript, to Spread Malware - The Plug - HelloTech","description":"Your computer can get infected by relatively innocent files like images and JavaScript attachments. Be careful before downloading anything!","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware","og_locale":"en_US","og_type":"article","og_title":"Attackers Now Use \u201cHarmless\u201d File Types, Like JavaScript, to Spread Malware - The Plug - HelloTech","og_description":"You probably already know that .EXE and .DLL files can contain malware and that you shouldn\u2019t download these file types if you\u2019re not sure of where they","og_url":"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware","og_site_name":"The Plug - HelloTech","article_publisher":"http:\/\/www.facebook.com\/hellotech","article_published_time":"2017-02-13T20:30:51+00:00","article_modified_time":"2021-06-13T18:19:08+00:00","og_image":[{"width":640,"height":426,"url":"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2017\/02\/laptop-1146825_640-min.jpg","type":"image\/jpeg"}],"author":"admin","twitter_card":"summary_large_image","twitter_creator":"@HelloTech","twitter_site":"@HelloTech","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware#article","isPartOf":{"@id":"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware"},"author":{"name":"admin","@id":"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/dec00225dd888a509740ace5e4d9de6c"},"headline":"Attackers Now Use \u201cHarmless\u201d File Types, Like JavaScript, to Spread Malware","datePublished":"2017-02-13T20:30:51+00:00","dateModified":"2021-06-13T18:19:08+00:00","mainEntityOfPage":{"@id":"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware"},"wordCount":869,"publisher":{"@id":"https:\/\/www.hellotech.com\/blog\/#organization"},"articleSection":["News","Staying Safe"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware","url":"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware","name":"Attackers Now Use \u201cHarmless\u201d File Types, Like JavaScript, to Spread Malware - The Plug - HelloTech","isPartOf":{"@id":"https:\/\/www.hellotech.com\/blog\/#website"},"datePublished":"2017-02-13T20:30:51+00:00","dateModified":"2021-06-13T18:19:08+00:00","description":"Your computer can get infected by relatively innocent files like images and JavaScript attachments. Be careful before downloading anything!","breadcrumb":{"@id":"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.hellotech.com\/blog\/javascript-spread-malware"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.hellotech.com\/blog\/javascript-spread-malware#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.hellotech.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Attackers Now Use \u201cHarmless\u201d File Types, Like JavaScript, to Spread Malware"}]},{"@type":"WebSite","@id":"https:\/\/www.hellotech.com\/blog\/#website","url":"https:\/\/www.hellotech.com\/blog\/","name":"The Plug - HelloTech","description":"Turn to The Plug for informative tech news that you can use. ","publisher":{"@id":"https:\/\/www.hellotech.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.hellotech.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.hellotech.com\/blog\/#organization","name":"HelloTech","url":"https:\/\/www.hellotech.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hellotech.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2018\/11\/HT-logo-revised-final.png","contentUrl":"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2018\/11\/HT-logo-revised-final.png","width":1000,"height":174,"caption":"HelloTech"},"image":{"@id":"https:\/\/www.hellotech.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["http:\/\/www.facebook.com\/hellotech","https:\/\/twitter.com\/HelloTech","http:\/\/www.instagram.com\/hello_tech","https:\/\/www.youtube.com\/channel\/UCIR-fbAKRfVuAbciDr2z4nQ"]},{"@type":"Person","@id":"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/dec00225dd888a509740ace5e4d9de6c","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/cbb537d18df244ad7d57a3639d94ede5cd90bf1fb742392af5731beaf11ffeb1?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/cbb537d18df244ad7d57a3639d94ede5cd90bf1fb742392af5731beaf11ffeb1?s=96&d=mm&r=g","caption":"admin"}}]}},"_links":{"self":[{"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/posts\/8531","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/comments?post=8531"}],"version-history":[{"count":0,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/posts\/8531\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/media\/8563"}],"wp:attachment":[{"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/media?parent=8531"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/categories?post=8531"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/tags?post=8531"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}