Summary:
Threat actors are exploiting free online document converter tools to infect victims' computers with malware, including ransomware. The FBI's Denver Field Office has issued a warning, noting an increase in scams involving these tools, which claim to convert or merge files (such as turning a .doc file into a .pdf or combining multiple .jpg files into one .pdf) or, in some cases, masquerade as MP3 or MP4 downloaders. While these services may appear to function as advertised, they often deliver files containing hidden malware, enabling cybercriminals unauthorized access to victims’ systems. As users unknowingly upload their files to these fraudulent tools, attackers are able to further extract sensitive information such as social security numbers, phone numbers, banking details, email addresses, passwords, and more.

Security Officer Comments:
The tactic of impersonating online document converter tools is not novel and has been previously documented by security firms like Cyble. In particular, Cyble has observed threat actors setting up phishing sites masquerading as the legitimate Convertio service to target end users. In these attacks, users who downloaded their “converted” files instead received a zip archive containing a malicious shortcut file (“YourConvertedFile.lnk”). This file ultimately delivers RedLine Stealer malware, which is capable of extracting sensitive information from web browsers, cryptocurrency wallets, and applications such as FileZilla, Discord, Steam, and Telegram.

Suggested Corrections:
The FBI Denver Field Office recommends taking the following actions to protect yourself from this scam:

• Take a breath, slow down, and think. Be aware of your actions online and what risks you could be exposed to.
• Keep your virus scan software up to date and scan any file you receive before opening it to help eliminate malicious software from being installed on your computer.

If you are a victim of this scam, here are some steps to take:

• Contact your financial institutions immediately. Take steps to protect your identity and your accounts.
• Change all your passwords using a clean, trusted device.
• Make a report at IC3.gov
• Run up-to-date virus scan software to check for potentially malicious software installed by the scammers. Consider taking your computer to a professional company specializing in virus and malware removal services.

Link(s):
https://www.fbi.gov/contact-us/fiel...bi-denver-warns-of-online-file-converter-scam