A clever phishing scam is targeting cPanel users with a fake security advisory alerting them of critical vulnerabilities in their web hosting management panel.
cPanel is administrative software commonly installed on shared web hosting services that allow website owners to easily administer their site through a graphical user interface.
Starting on Wednesday, cPanel and WebHost Manager (WHM) users began reporting a targeted phishing email campaign with an email subject of “cPanel Urgent Update Request” that was pretending to be a security advisory from the company.
This fake advisory stated that updates had been released to fix “security concerns” in cPanel and WHM software versions 88.0.3+, 86.0.21+, and 78.0.49+, and recommends all users install the updates.
“cPanel Urgent Update Notification
cPanel has released new builds for all public update tiers.
These updates provide targeted changes to address security concerns with the cPanel & WHM product. These builds are currently available to all customers via the standard update system.
cPanel has rated these updates as having CVSSv3 scores ranging from 3.3 to 9.9.
Information on cPanel’s security ratings is available at https://go.cpanel.net/securitylevels.
We strongly encourage you to update your cPanel & WHM installations at your earliest convenience.
Update your cPanel & WHM installations
RELEASES
The following cPanel & WHM versions address all known vulnerabilities:
88.0.3 & Greater
86.0.21 & Greater
78.0.49 & GreaterSECURITY ISSUE INFORMATION
The cPanel Security Team identified the resolved security issues. There is no reason to believe that these vulnerabilities have been made known to the public. As such, cPanel will only release limited information about the vulnerabilities at this time.
Once sufficient time has passed, allowing cPanel & WHM systems to automatically update to the new versions, cPanel will release additional information about the nature of the security issues. This Targeted Security Release addresses 10 vulnerabilities in cPanel & WHM software versions 88, 86, and 78.
For information on cPanel & WHM Versions and the Release Process, read our documentation at: https://go.cpanel.net/versionformat
Sincerely,
cPanel Team”
Unlike many phishing scams seen by BleepingComputer, the attackers in this campaign took time and effort to construct a convincing attack.
In addition to a well-worded email with little or no grammar and spelling issues, the threat actors used language commonly found in security advisories.
The attackers registered the domain ‘cpanel7831.com’ to make the scam appear as an authentic advisory from cPanel and are using Amazon Simple Email Service (SES) to send out the emails.
A fake security advisory from cPanel
If a recipient of this phishing email falls for the scam and clicks on the ‘Update your cPanel & WHM installations’, they were brought to a website that prompted a user to log in with their cPanel credentials.
At this time, the phishing landing page is currently down and redirects to a Google search for the keyword ‘cpanel.’
As this is a well-done and convincing scam, it would not be surprising if some users fell for the scam.
If you received a similar email recently and entered your login credentials at the site, it is strongly suggested that you immediately log in to your web hosting provider and change the password on your account.
You should then perform a complete audit of your site while paying extra protection to the addition of strange PHP files that can be used as backdoors. Also, be sure to examine the website’s .htaccess file for changes that automatically inject malicious code into every web page or redirect visitors.
Source: (https://www.bleepingcomputer.com/)
