It’s not the first time scammers have tried using trojans (files disguised as or hidden within other files) to scam people out of their passwords or into giving up control of their computer – it’s just the first time it’s been used to target artists.
Artists online are not some secret vein of riches. They do, however, tend to have a ton of contacts, and if your scam would benefit from having tons and tons of people to send emails to, then a digital artist who takes commissions online is as good a target as any.
For context, in the digital art world, artists who are commissioned for works fully online will often need reference pictures sent digitally – and high resolution photos may be too big to send over without some additional formatting. In this case, sending a .zip file (a file type that compresses the image’s size) may be necessary to get the file delivered at all. Even then, the file itself should still be at least a number of megabytes, not kilobytes. Smaller pictures, like rough digital workups for concept or character art, are normally small enough to be sent without any modifications to the file type, and can be .webps, .pngs, .jpegs, et cetera.
A VBS file is a type of file that comes from Visual Basic, a coding language. A VBS file is therefore a small packet of code. The way the scam works, a scammer sends a VBS file, says “this is a reference picture for what I want you to draw”, and then when the artist tries to open the file, it runs whatever code is in there on the artist’s computer. It could be ransomware, it could be a Trojan designed to steal data and run in the background, it could be any number of things.
The artist will probably know something is wrong when they open it, but they likely won’t know exactly what the code did in time to stop or fix it.
The best practices for avoiding phishing don’t really apply in digital space. Artists from all over the world can make art for commissioners who live anywhere! Two total strangers can exchange money for services from time zones 12 hours apart or more. It’s a really exciting time to be alive, but the unfortunate downside is that scammers from anywhere can send people harmful files and there’s little way to pursue them legally for it.
Instead, one of the best ways to avoid getting scammed (at least in this one specific way) is to state outright that only certain file types will be accepted. Recognizing every type of file where it’s possible for that file to start executing code is really difficult, but narrowing down the types of file you’ll take to types that you know cannot be tampered with or launch code from is much, much easier. This also works for people who have to work with unconventional or uncommon file types, like people who do embroidery work on programmable embroidery machines, 3D Print and 3D File artists, and more. Decline to accept .xlsx files when you know your apps cannot open it, and you’ll save yourself a lot of headache!
That said, this is part of a more worrying trend in modern scamming online. Artists, again, are not exactly known for being wealthy! Digital artists even moreso. Instead, the information that can be snatched – Discord logins, contact emails, PayPal and Zelle addresses, et cetera – are the target. It distributes the attack to everyone who’s ever contacted that artist. This is an even more annoying way of doing things than normal hacks, because the artist now may want to go through their contacts and alert people that their account was stolen or that their contact list was copied to somewhere unknowable, rather than just resetting their password on their Discord account. Ransomware is also not easy to deal with, and this is a viable method of distributing it. While some ransomwarers like to believe their industry is akin to honorable piracy, not all ransomware distributors think alike, and some may keep data even after they get the payment they demand.
It’s tough to defend against. It’s a combination of social engineering and actual hacking. It requires a level of programming literacy that a lot of people don’t have. Who’s fiddling with VBS files? Most people aren’t! People learning how to code are usually going through Powershell, Python, or C+. People trying to make games are using programs like Godot. First-timers in all of these wouldn’t recognize a VBS file.
