Collaborate Disseminate
There was another big overnight Locky malspam run in UK last night. (about 1300 copies so far, not quite as aggressive as some recent Locky campaigns which have delivered ~1500 copies in 20 minutes ) The next in the never ending series of Locky downloaders is an email with the … Continue reading → Continue reading More Locky ransomware delivered by Emailing: Payment_201708-### malspam
The next in the never ending series of Locky downloaders is an email with the subject of You have received a scan from AT Management pretending to come from Scan @ AT Management <scan_754@atmanagement.co.uk> [random numbers after the scan_] All these are being addressed to Accounts: <name@victiomdomain.tld> They use email addresses … Continue reading → Continue reading You have received a scan from AT Management malspam delivering Locky ransomware
An email with the subject of Important – Protected Documents pretending to come from Lloyds Bank but actually coming from a look-a-like domain Lloyds Bank <donotreply@lloydsbankprotected.com> or Lloyds Bank <donotreply@lloydsbankprotected.co.uk> with a malicious word doc attachment is today’s latest spoof of a well-known company, bank or public authority delivering Trickbot banking Trojan … Continue reading → Continue reading More fake Lloyds Bank Important – Protected Documents malspam delivering Trickbot banking Trojan
Today’s first mass malspam in the never ending series of Locky downloaders is a typically unbelievable email, that of course will encourage recipients to open the attachment because it is so stupid and obviously nothing to do with BT. However because it pretends to come from somebody else on your email … Continue reading → Continue reading Fake BT bill pretending to come from your own email address or company delivers Locky ransomware
Today’s first mass malspam in the never ending series of Locky downloaders is a typically unbelievable email, that of course will encourage recipients to open the attachment because it is so stupid and obviously nothing to do with BT. However because it pretends to come from somebody else on your email … Continue reading → Continue reading Fake BT bill pretending to come from your own email address or company delivers Locky ransomware
We see a lot of Amazon phishing attempts. This one is quite different to the usual ones we see. Although there are a lot of Amazon sellers, the chances of a mass malspam like this one actually being received by a seller is quite small compared with the more usual … Continue reading → Continue reading You sold an item spam is an amazon phishing attempt
We continue to be plagued almost daily by fake order or contract emails containing java adwind or Java Jacksbot attachments. Many Antiviruses on Virus Total normally detect these heuristically. However today’s version is very poorly detected. The one saving grace with these is that Outlook and many other email clients … Continue reading → Continue reading Purchase Contract of PO30/PO31 delivers java adwind
Continuing with the never ending series of malware laden emails is an email with the subject of DHL GLOBAL FREIGHT CONSIGNMENT FORM coming from DHL GLOBAL WORLD WIDE AGENT <deddi@karebet-group.com> with a .ace attachment delivers malware that looks like a pony dropper and /or fareit password stealer trojan Update: returns are coming back from … Continue reading → Continue reading Fake DHL GLOBAL FREIGHT CONSIGNMENT FORM malspam delivers malware
An email with the subject of You have a new secure Message pretending to come from Lloyds Bank but actually coming from a look-a-like domain Lloyds Bank <message@lloydsbankmsg.com> or Lloyds Bank <message@lloydsbank-msg.com> or Lloyds Bank <message@lloydsbankmsg.co.uk> and to make up a full house of possible combinations we also have Lloyds Bank <message@lloydsbank-msg.co.uk> with … Continue reading → Continue reading Fake Lloyds Bank You have a new secure Message malspam delivers Trickbot banking Trojan
An email with the subject of Your Sage subscription invoice is ready pretending to come from Sage but actually coming from a look-a-like domain noreply@sagetop.com with a malicious word doc attachment is today’s latest attempt to deliver Locky ransomware They are using email addresses and subjects that will scare or entice a … Continue reading → Continue reading Your Sage subscription invoice is ready deliver Locky ransomware