Collaborate Disseminate
Continuing from Last Friday’s return of Locky, today we are seeing another mass malspam onslaught with 2 separate email with the subject of Scan Data or 12345678.pdf ( random numbers) pretending to come from random email addresses at your own email domain with a PDF attachment that contains an embedded malicious word … Continue reading → Continue reading Locky continues using pdf files with embedded macro word docs
We have recently been seeing a newer method of infecting you by embedding macro enabled word docs into pdf files. To all intents and purposes these PDF files look quite innocent and will normally be an almost blank page with 1 line of text These recent posts illustrate the attack … Continue reading → Continue reading Embedded documents in PDF files that can easily infect you
After several weeks break we have the return of Locky ransomware with an email with the subject of Payment Receipt 2724 or something similar pretending to come from random companies with a pdf attachment containing an embedded malicious word macro enabled doc which will download an encrypted txt file that is transformed … Continue reading → Continue reading The return of Locky ransomware with fake receipts malspam
We see lots of phishing attempts for email credentials. This one is no different to hundreds that we regularly receive. It pretends to be a message from IT support telling you that your mailbox is nearly full and you need to log in to optimise it. I wouldn’t normally post … Continue reading → Continue reading The difficulties in determining a phishing site
My apologies for the site being unavailable yesterday 20 April 2017. ( Afternoon and Evening UK time). There was an outage in the data centre that hosts this server. The reason given to me was a firewall cluster error or failure. This resulted in name resolution problems, so nobody could … Continue reading → Continue reading Data centre problems, site not available yesterday
An email with the subject of Copy of your 123-reg invoice ( 123-230044839 ) [random numbers] pretending to come from no-reply@123-reg.co.uk with a malicious pdf attachment that contains an embedded word doc delivers Dridex banking Trojan. They are using email addresses and subjects that will scare or entice a user to read the email … Continue reading → Continue reading fake Copy of your 123-reg invoice delivers Dridex banking Trojan
We are so used to seeing USPS, UPS, DHL. FEDEX and all the other delivery companies being spoofed with emails pretending to be from them delivering all sorts of malware, usually via zip attachments containing JavaScript files. There have been 2 main campaigns that I have documented HERE and HERE Recently the … Continue reading → Continue reading More USPS delivering Zbot Zeus Panda via fake Word online sites
Continuing with the regular series of Japanese language malspam emails is today’s overnight onslaught with the subject of Express Mail Service (EMS) pretending to come from japanexpress@post.japanpost.jp. I am also getting a lot of emails with a malformed subject line ?iso-2022-jp?B?RU1TGyRCR1tDIz51NjckTjNORycbKEIgLSAbJEJNOUpYNkkbKEIgLSAbJEJGfEtcTTlALxsoQg==?= or ?iso-2022-jp?B?GyRCTT05cEw1JDckTk8iTW1AaEpROTkkZCUiJUklbCU5SlE5ORsoQiA=?= which I assume is an encoding error and it is … Continue reading → Continue reading fake Japan Post Express Mail Service (EMS) malspam delivers Ursnif /Gozi /Papras banking trojan
Continuing with the regular series of Japanese language malspam emails is today’s overnight onslaught with the subject of Express Mail Service (EMS) pretending to come from japanexpress@post.japanpost.jp. I am also getting a lot of emails with a malformed subject line ?iso-2022-jp?B?RU1TGyRCR1tDIz51NjckTjNORycbKEIgLSAbJEJNOUpYNkkbKEIgLSAbJEJGfEtcTTlALxsoQg==?= or ?iso-2022-jp?B?GyRCTT05cEw1JDckTk8iTW1AaEpROTkkZCUiJUklbCU5SlE5ORsoQiA=?= which I assume is an encoding error and it is … Continue reading → Continue reading fake Japan Post Express Mail Service (EMS) malspam delivers Ursnif /Gozi /Papras banking trojan
We see lots of phishing attempts for Paypal login account credentials. This one is slightly different than many others, mainly in the way the phisher has set up the phishing site. In Internet Explorer you get a “site Hacked” message but in Firefox or Chrome, you get the PayPal Phishing … Continue reading → Continue reading Don’t be blocked!!! – PayPal Phishing