A new sophisticated phishing tactic has been identified that involves a malicious actor gaining access to an email account, monitoring a conversation thread, and then inserting malware in a reply to an ongoing discussion. The scam is a variation of a Business Email Compromise (BEC) attack. BEC attacks typically involve using a compromised email account to send messages to accounts or payroll employees to get them to make fraudulent bank transfers to accounts controlled by the attacker. In this case, the aim is to install a banking Trojan called Ursnif. Ursnif is one of the most commonly used banking...