Author Archives: Myonlinesecurity

Scanned image malspam with pdf attachment delivers jaff ransomware

Posted on by

An email with the subject of  Scanned image coming or pretending to come from random email addresses with a pdf attachment that contains an embedded malicious word doc delivers jaff ransomware This looks like a continuation of yesterday’s big malspam run that delivered a new ransomware Jaff ransomware This particular malspam run started … Continue reading → Continue reading Scanned image malspam with pdf attachment delivers jaff ransomware→

Ursnif banking Trojan delivered by fake invoices using word docs with embedded ole objects

Posted on by

Continuing with today’s Ursnif /Gozi /ISFB banking Trojans. This one is using a different delivery method to try to throw us off track. Whereas today’s earlier ones spoofing DHL [1] [2] used standard .js files inside zips, this has a word docx attachment that contains an embedded ole object that … Continue reading → Continue reading Ursnif banking Trojan delivered by fake invoices using word docs with embedded ole objects→

More fake DHL Fwd: DHL Redelivery Confirmation malspam delivering ursnif banking trojan

Posted on by

Continuing with the never ending series of malware downloaders is an email with the subject of Fwd: DHL Redelivery Confirmation #574068024996 ( random numbers) pretending to come from random companies, names and email addresses with a semi-random named zip attachment  which delivers  Ursnif banking Trojan. This is an updated version to this … Continue reading → Continue reading More fake DHL Fwd: DHL Redelivery Confirmation malspam delivering ursnif banking trojan→

fake Royal Bank of Scotland Secure Message delivers Trickbot banking Trojan

Posted on by

An email with the subject of Secure Message pretending to come from RBS Royal Bank of Scotland but actually coming from a look alike domain Royal Bank of Scotland <no-reply@rbs-secure-message.co.uk>  with a malicious word doc attachment  is today’s latest spoof of a well known company, bank or public authority delivering Trickbot banking Trojan … Continue reading → Continue reading fake Royal Bank of Scotland Secure Message delivers Trickbot banking Trojan→

more malware via embedded word macro docs in pdf attachments

Posted on by

Nothing special about the emails that are delivering this malware version. It is a typical  well used email template with subjects varying from with literally hundreds if not thousands of subjects. These generally deliver either Locky ransomware or Dridex banking Trojan File_69348406 PDF_9859 Scan_2441975 Document_11048 Copy_9762   They all have … Continue reading → Continue reading more malware via embedded word macro docs in pdf attachments→

fake DHL Statements x Requests Required delivers malware

Posted on by

Continuing with the never ending series of malware downloaders is an email with the subject of 6109175302 Statements x Requests Required ( random numbers)  pretending to come frombgyhub@dhl.com with a zip attachment containing 2 differently named .js files which delivers some sort of malware. I am not certain yet what it is but … Continue reading → Continue reading fake DHL Statements x Requests Required delivers malware→

fake HSBC Bank – 24086 Loan Program Notification malspam delivers hancitor

Posted on by

Continuing with the never ending series of malware downloaders is an email with the subject of HSBC Bank – 24086 Loan Program Notification coming  from noreply9@creditsupport.gdn which delivers what looks like hancitor malware. It is quite unusual for malware authors to use 7zip (7z) compressed ( zip ) files, although most current extraction … Continue reading → Continue reading fake HSBC Bank – 24086 Loan Program Notification malspam delivers hancitor→

remote code execution in the Microsoft Malware Protection Engine CVE-2017-0290

Posted on by

There has been a recently discovered remote code execution in the Microsoft Malware Protection Engine that had the potential to allow an attacker to completely take over affected computers. This has been fixed by Microsoft in an update to the Microsoft Malware Protection Engine in affected programs. This will automatically apply, … Continue reading → Continue reading remote code execution in the Microsoft Malware Protection Engine CVE-2017-0290→

Fake HSBC Payment advice delivers malware

Posted on by

Continuing with the never ending series of malware downloaders is an email with the subject of FW: Payment Advice – Advice Ref:[G32887529930] / Priority payment / Customer Ref:[03132394] pretending to come from HSBC Advising Service <050717.advisingservice@mail.com>. These are quite well detected on VirusTotal but as generic or heuristic detections, so I am … Continue reading → Continue reading Fake HSBC Payment advice delivers malware→

fake live.com update your mailbox phishing scam

Posted on by

We see lots of phishing attempts for email credentials. This one is slightly different than many others. It pretends to be a message from Email Support to Update Your Mailbox. Of course these don’t come from Microsoft or Live.com but are spoofed to appear to come from them. They use email … Continue reading → Continue reading fake live.com update your mailbox phishing scam→