Bogus Electronic Frontier Foundation site targets users with malware

A spear phishing campaign used the name of the Electronic Frontier Foundation to exploit victims' trust.


Kate Conger


Posted on Aug 30, 2015   Updated on May 28, 2021, 1:48 am CDT

The Electronic Frontier Foundation (EFF) announced this week that a fake website using the organization’s name was linked to a malware and spear phishing attack. 

The website used the domain (EFF’s true domain is and was set up earlier this month. 

Spear phishing attacks work by taking advantage of a person’s trust in a familiar website. An attacker might send a link to a victim that appears trustworthy—for instance, if a victim is familiar with EFF, they might see an link and not hesitate to click it. However, once a victim clicks the link, malware is installed onto his or her computer, which can then be used by an attacker to exploit it. 

In this case, EFF suspects that the malware is Sednit, which could be used to install a keylogger—which tracks everything the victim types—or other software.

“It appears to have been used in a spear phishing attack, though it is unclear who the intended targets were,” EFF staff technologist Cooper Quintin wrote in a blog post

Quintin said the attack is “relatively sophisticated” and uses a Java exploit to install its malware. He also noted that the malware is similar to that used in a larger spear phishing campaign known as Pawn Storm, which is thought to be associated with the Russian government. 

EFF says it was alerted to the site’s existence by Google‘s security team. EFF reported the domain and says Oracle has patched the Java bug that allowed the malware to be installed. 

“Of course this is an excellent reminder for everyone to be vigilant against phishing attacks,” Quintin wrote. “Our SSD guide contains advice on how to improve your security, watch for malicious emails, and avoid phishing attacks such as this one.” 

H/T Hackread | Illustration by Max Fleishman 

Share this article
*First Published: Aug 30, 2015, 2:22 pm CDT