Author Archives: Myonlinesecurity

Please see the attached invoice and remit payment – JS malware

Posted on by

Last revised or Updated on: 28th March, 2016, 10:27 AMA second set of malspam emails this Easter Monday Morning is an email with the subject of  FW:   pretending to come from random senders   with a zip attachment is another one from the current bot runs which downloads some sort of malware probably either Ransomware or a keylogger and banking Trojan. Update. Definitely is Locky Ransomware They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Although the attachments are named in a similar way to today’s slightly earlier malspam run … Continue reading → Continue reading Please see the attached invoice and remit payment – JS malware→

FW: Overdue Incoices – JS malware leads to Locky ransomware

Posted on by

Last revised or Updated on: 28th March, 2016, 12:40 PMEven though it is the Easter Monday Bank Holiday in UK the Malspam emails keep coming. Starting with an email that they really should have spellchecked before sending. It the mispelled subject of  FW: Overdue Incoices pretending to come from random senders  with a zip attachment is another one from the current bot runs which downloads Locky ransomware They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The name of the alleged sender matches the name in the body of … Continue reading → Continue reading FW: Overdue Incoices – JS malware leads to Locky ransomware→

FW: Invoice Copy pretending to come from a random or unknown name at your own email address – JS malware leads to Locky ransomware

Posted on by

Last revised or Updated on: 25th March, 2016, 1:37 PMAlthough it is Good Friday  ( A bank and Public Holiday in UK and several other countries) and the start of the long Easter weekend and holiday, the Locky ransomware campaign continues unabated with a n email with the subject of  FW: Invoice Copy  pretending to come from a random or unknown name at  your own email address  with a zip attachment is another one from the current bot runs which downloads Locky ransomware They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than … Continue reading → Continue reading FW: Invoice Copy pretending to come from a random or unknown name at your own email address – JS malware leads to Locky ransomware→

Sixt Invoice: 0252056792 from 24.03.2016 – word macro malware

Posted on by

Last revised or Updated on: 24th March, 2016, 4:23 PMAn email with the subject of Sixt Invoice: 0252056792 from 24.03.2016 ( random numbers)   pretending to come from random names, companies and email addresses with a malicious word doc attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Sixt car rental  sixt.com has … Continue reading → Continue reading Sixt Invoice: 0252056792 from 24.03.2016 – word macro malware→

Attached document(s) Afifa Shohab – JS malware

Posted on by

Last revised or Updated on: 24th March, 2016, 1:45 PMAn empty blank email with the subject of  Attached document(s) pretending to come from Afifa Shohab <afifashohab4650@gmail.com>  with a zip attachment is another one from the current bot runs which downloads They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Afifa Shohab has not been hacked or had his or  her email or other servers compromised. Hs or She is not sending the emails to you. He or  She is just an innocent victim in exactly the same way as every recipient of … Continue reading → Continue reading Attached document(s) Afifa Shohab – JS malware→

How easy it is to be a scammer

Posted on by

Last revised or Updated on: 24th March, 2016, 2:08 PMI have seen literally hundreds of scam and phishing sites over the last few weeks. We always see them but there has been a massive increase recently. I decided to do a bit of investigation and found a registrar selling the new domain names at absolutely silly prices. £0.88 for 1 year. At that price any scammer can register loads of domains and throw them away as soon as they have used them for 1 or 2 days phishing The registrar I found was https://www.namecheap.com/ I thought lets check this out and decided to purchase an XYZ domain with a nice phishy name  apple-update.xyz I have seen loads of similar examples … Continue reading → Continue reading How easy it is to be a scammer→

Monica Schiavone Fattura N.: 6284053/F del 23/03/2016 – JS malware

Posted on by

Last revised or Updated on: 24th March, 2016, 12:34 PMAn Italian language  email with the subject of  Fattura N.: 6284053/F   del 23/03/2016 [ random numbered]  pretending to come from Monica Schiavone <monica@formaefunzione.com> with a zip attachment is another one from the current bot runs which downloads They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Monica Schiavone  monica@formaefunzione.com has not been hacked or had her email or other servers compromised. She is not sending the emails to you. She is just an innocent victim in exactly the same way as every recipient of … Continue reading → Continue reading Monica Schiavone Fattura N.: 6284053/F del 23/03/2016 – JS malware→

Axminster Tools & Machinery Your order has been despatched – word macro malware

Posted on by

Last revised or Updated on: 24th March, 2016, 10:49 AMAn email with the subject of Your order has been despatched pretending to come from customer.service@axminster.co.uk with a malicious word doc  attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Axminster Tools & Machinery http://www.axminster.co.uk  has not been hacked or had their email or other … Continue reading → Continue reading Axminster Tools & Machinery Your order has been despatched – word macro malware→

Contract ID 95669 has been terminated – JS malware leads to Teslacrypt

Posted on by

Last revised or Updated on: 23rd March, 2016, 2:18 PMAn email with the subject of  Contract ID 95669 has been terminated [ random numbered]  pretending to come from random names and senders  with a zip attachment is another one from the current bot runs which downloads Teslacrypt ransomware They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The email looks like: From: Random names and email addresses Date: Wed 23/03/2016 13:07 Subject: Contract ID 95669 has been terminated Attachment: confirm_87844607.zip Body content: Dear Customer,   We … Continue reading → Continue reading Contract ID 95669 has been terminated – JS malware leads to Teslacrypt→

The Back Office : Invoice ( MJINV78470 ) – word doc rtf macro malware

Posted on by

Last revised or Updated on: 23rd March, 2016, 1:41 PMAn email with the subject of The Back Office : Invoice ( MJINV78470 )  pretending to come from random senders  with a malicious word doc RTF attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The Back Office, who I assume is meant to … Continue reading → Continue reading The Back Office : Invoice ( MJINV78470 ) – word doc rtf macro malware→