Author Archives: Myonlinesecurity

Fake Anna Mills Baby Bottles Wholesale Limited Copy Credit Note malspam delivers malware

Posted on by

Continuing with the never ending series of malware downloaders is an email with the subject of Copy Credit Note  coming or pretending to come from Anna Mills anna.mills@ random email addresses with a semi-random named zip attachment which contains another zip file which delivers a wsf file eventually delivering what looks like … Continue reading → Continue reading Fake Anna Mills Baby Bottles Wholesale Limited Copy Credit Note malspam delivers malware→

blank email with no subject tries to deliver malware but fails

Posted on by

The malware gang trying to deliver what should be either Dridex, Jaff or  Trickbot have made an almighty mistake this morning The email is typical with  no subject & a blank empty body with a zip attachment. So far nothing unusual in that. BUT what the apprentice looking after the shop … Continue reading → Continue reading blank email with no subject tries to deliver malware but fails→

Another fake eFax email delivers malware via ole rtf exploit

Posted on by

Another fake eFax email that I never got round to dealing with yesterday. subject of eFax message from “116 – 921 – 1271 ” – 5 page(s) pretending to come from eFax Inc <noreply@efax.com>  with a  zip attachment containing a malicious word doc They are using email addresses and subjects that will … Continue reading → Continue reading Another fake eFax email delivers malware via ole rtf exploit→

fake eFax message from “0300 200 3835” – 2 page(s) malspam delivers smoke /sharik /dofoil and Trickbot

Posted on by

An email with the subject of eFax message from “0300 200 3835” – 2 page(s) pretending to come from efax  but actually coming from a look alike domain eFax <message@mail.efaxcorporate254.top>   with a malicious word doc attachment  is today’s latest spoof of a well known company, bank or public authority delivering  Sharik /Smoke … Continue reading → Continue reading fake eFax message from “0300 200 3835” – 2 page(s) malspam delivers smoke /sharik /dofoil and Trickbot→

Message from KM_C224e with zip attachment delivers new version of Cerber Ransomware

Posted on by

Following on from last weeks  Dridex campaign using Message from KM_C224e is today’s somewhat different version using the same subject and email template but with a zip attachment containing a .exe file. They still pretend to come from copier @ your own email domain. These are delivering Cerber  Ransomware Update: this … Continue reading → Continue reading Message from KM_C224e with zip attachment delivers new version of Cerber Ransomware→

More Trickbot with blank emails using scan_1234.doc attachments as a delivery lure

Posted on by

Following on from today’s earlier Trickbot malspam campaign we are seeing a new malspam campaign using macro enabled word docs that download from a new range of sites but still use the 7gyb3ds file name for the encrypted text malware. This time it is an email with a blank or empty  subject  as well as … Continue reading → Continue reading More Trickbot with blank emails using scan_1234.doc attachments as a delivery lure→

Fake O365 message Important Upgrade Is Required – Phishing

Posted on by

We see lots of phishing attempts for email credentials. This one is a typical one. It pretends to be a message from Microsoft Office365 saying your mailbox is full. It is so obvious from the style of the email that these are not written by a native English speaker. I … Continue reading → Continue reading Fake O365 message Important Upgrade Is Required – Phishing→

more fake invoice pdf that drop a word macro delivering banking malware

Posted on by

Continuing with the latest series of emails with pdf attachments that drops a malicious macro enabled word doc is an email with the subject of 32_Invoice_2220 ( random numbers at start and end of invoice) pretending to come from random names  and email addresses that delivers what looks like either … Continue reading → Continue reading more fake invoice pdf that drop a word macro delivering banking malware→

More Japanese Language invoice malspam delivering ursnif banking Trojan

Posted on by

Back to the never ending series of Japanese language malspam malware downloaders delivering Ursnif /Gozi / ISFB banking Trojan is yet another email with the subject of 請求書を添付 (Attach invoice). These emails are coming in slightly malformed and outlook doesn’t want to open them or display them properly. This might be … Continue reading → Continue reading More Japanese Language invoice malspam delivering ursnif banking Trojan→

WakeMed SERVICE DESK YOUR MAILBOX HAS BEEN LOGIN SOME WHERE ELSE – very poor attempt at Phishing

Posted on by

We see lots of phishing attempts for email credentials. This one must be amongst the most inept attempts I have seen in a very long time. It pretends to be a message to change your password because your mailbox has been login some where else (sic) They use email addresses … Continue reading → Continue reading WakeMed SERVICE DESK YOUR MAILBOX HAS BEEN LOGIN SOME WHERE ELSE – very poor attempt at Phishing→