Collaborate Disseminate
We haven’t seen Locky for a long time, so I was quite surprised to see this one. It is an email with the subject of Copy of Invoice 79898702coming or pretending to come from noreply@random email addresses with a semi-random named zip attachment in the format of 79898702.zip ( random 8 … Continue reading → Continue reading The return of Locky with fake invoice emails
We see lots of phishing attempts. When I saw this email, my immediate first thought was another Amazon phish trying to get my account credentials or even a malware download attempt. We frequently see both with similar spoofed / fake Amazon emails. But no it is a pure and simple … Continue reading → Continue reading fake Amazon.com – Your Cancellation (127-3451-3158) spam weight loss pill scam
An email with the subject of Commercial Invoice pretending to come from export@dhl-invoice.com with a malicious Excel XLS spreadsheet attachment delivers some sort of malware. I don’t know what this is at the moment and online sandboxes or VirusTotal aren’t really helping either. No doubt one of my contacts will soon tell … Continue reading → Continue reading Fake DHL Commercial Invoice malspam delivers malware
We see lots of phishing attempts for email credentials. This one is slightly different than many others. It pretends to be a message from your email provider saying Your Mailbox Will Be Terminated. I have received several of these to different email addresses today all coming from genuine t-online.de IP numbers … Continue reading → Continue reading Your Mailbox Will Be Terminated – Phishing for email credentials
Back to Italian language malspam today with another fake invoice with an excel XLS attachment. Like most of these non English emails that I have recently received, there seems to be some degree of malformation and the body content comes as an html attachment rather than being displayed in the … Continue reading → Continue reading Italian language fake invoice delivers ransomware
We continue to be plagued by fake financial themed emails containing java adwind or Java Jacksbot attachments. I have previously mentioned many of these HERE. We have been seeing these sort of emails almost every day and there was nothing much to update. Today’s has a slightly different subject and … Continue reading → Continue reading Fw: Moneygram Maintenance Schedule – From 20th June 2017 malspam delivers java adwind
We see a lot of 419 ( Advance fee fraud ) scams and spam. Most just aren’t even worth mentioning, but every now and again one that is slightly interesting comes up. This one has nothing special about the scam itself, but is being mentioned because of the subject line and … Continue reading → Continue reading NOT A SPAM AS WRONGLY MARKED READ CAREFULLY AND RESPOND 419 spam scam
Continuing with the latest series of emails with pdf attachments that drops a malicious macro enabled Excel XLS file is an email with the subject of Emailing: 288639672 ( random numbers) pretending to come from random names and email address that delivers some sort of malware. Over the last couple of weeks … Continue reading → Continue reading Malspam with pdf attachments dropping macro excel xls files deliver malware
Following on from this post about Japanese Language invoice malspam delivering Ursnif, we are currently seeing another Japanese campaign about damaged photos. These contact the same sites as mentioned in the other post to download the same malware version. 48336.doc Current Virus total detections: Payload Security Which is still showing the same … Continue reading → Continue reading spoofed DHL email Japanese language malspam about damaged photo delivers ursnif
It looks like the Japanese malspams are still continuing to deliver Ursnif /Gozi / ISFB banking Trojans. This one is yet another fake invoice email with the subject of 請求書添付書類について (About invoice attachment documents) , pretending to come from random Japanese email addresses with a malicious Excel XLS attachment that contains macros … Continue reading → Continue reading Japanese language fake invoice malspam using macro laden XLS files continue to deliver Ursnif banking Trojans