Yet another change to the Trickbot Banking Trojan distribution system again today. Today the Trickbot gang are pretending that a scanner or multifunction device is emailing you a scanned document. We used to see this lure all the time from other malware distribution services, but they generally pretended that the email was coming from a device on your network, not a remote server like this example of Trickbot banking Trojan. This example is an email containing the subject of “Scanned from a Xerox Multifunction Printer ” pretending to come from Xerox Device but actually coming from “service@scandevice.uk” which is a look-a-like, typo-squatted or … Continue reading →