Category Archives: macro virus

More Fake NatWest Bank messages with a password protected word doc delivers trickbot

Posted on by

An email with the subject of Important : Incoming BACs Documents pretending to come from NatWest Bank but actually coming from a look-a-like domain Natwest <message@natwestbacs.co.uk>   or  Natwest <message@natwestbacs.com> with a password protected malicious word doc attachment  is today’s latest spoof of a well-known company, bank or public authority delivering Trickbot banking Trojan … Continue reading → Continue reading More Fake NatWest Bank messages with a password protected word doc delivers trickbot→

New Secure Message Royal Bank of Scotland delivers Trickbot banking Trojan

Posted on by

An email with the subject of New Secure Message Royal Bank of Scotland pretending to come from RBS  but actually coming from a look-a-like domain RBS bankline secure email <noreply@rbsbankline##.ml>   with a malicious word doc attachment  is today’s latest spoof of a well-known company, bank or public authority delivering Trickbot banking Trojan. … Continue reading → Continue reading New Secure Message Royal Bank of Scotland delivers Trickbot banking Trojan→

Fake Santander Bank Important – New Account Documents delivers Trickbot banking Trojan

Posted on by

An email with the subject of Important – New Account Documents pretending to come from Santander Bank  but actually coming from a look-a-like domain Santander <account.documents@santanderdoc.co.uk> or Santander <account.documents@santandersec.co.uk>   with a malicious word doc attachment  is today’s latest spoof of a well-known company, bank or public authority delivering Trickbot banking Trojan … Continue reading → Continue reading Fake Santander Bank Important – New Account Documents delivers Trickbot banking Trojan→

Trickbot banking Trojan continues to be delivered by spoof NatWest bank messages

Posted on by

The Trickbot gang have got a bit lazy today and continued with imitating NatWest Bank and using the same look-a-like domain as yesterday’s version. But using a slightly different email message. They have even re-used the same domains to deliver the actual payload, but with different file names. An email … Continue reading → Continue reading Trickbot banking Trojan continues to be delivered by spoof NatWest bank messages→

Fake Your Sage subscription invoice is Due delivers malware

Posted on by

An email with the subject of Your Sage subscription invoice is Due pretending to come from Sage but actually coming from a look-a-like domain SAGE UK <message@sagemailsupport14.top>  with a malicious word doc attachment  is another one of today’s  spoofs of a well-known company, bank or public authority delivering what I think … Continue reading → Continue reading Fake Your Sage subscription invoice is Due delivers malware→

More fake NatWest emails deliver Trickbot banking Trojan

Posted on by

An email with the subject of Secure email message pretending to come from NatWest bank  but actually coming from a look-a-like domain noreply@ servicemessage###.ml  with a malicious word doc attachment  is today’s latest spoof of a well-known company, bank or public authority delivering Trickbot banking Trojan. The ### is any number between … Continue reading → Continue reading More fake NatWest emails deliver Trickbot banking Trojan→

More fake Lloyds Bank Important – Protected Documents malspam delivering Trickbot banking Trojan

Posted on by

An email with the subject of Important – Protected Documents pretending to come from Lloyds Bank  but actually coming from a look-a-like domain Lloyds Bank <donotreply@lloydsbankprotected.com> or Lloyds Bank <donotreply@lloydsbankprotected.co.uk>  with a malicious word doc attachment  is today’s latest spoof of a well-known company, bank or public authority delivering Trickbot banking Trojan … Continue reading → Continue reading More fake Lloyds Bank Important – Protected Documents malspam delivering Trickbot banking Trojan→

Fake Lloyds Bank You have a new secure Message malspam delivers Trickbot banking Trojan

Posted on by

An email with the subject of You have a new secure Message pretending to come from Lloyds Bank  but actually coming from a look-a-like domain Lloyds Bank <message@lloydsbankmsg.com> or  Lloyds Bank <message@lloydsbank-msg.com> or Lloyds Bank <message@lloydsbankmsg.co.uk>  and to make up a full house of possible combinations we also have Lloyds Bank <message@lloydsbank-msg.co.uk>  with … Continue reading → Continue reading Fake Lloyds Bank You have a new secure Message malspam delivers Trickbot banking Trojan→

Your Sage subscription invoice is ready deliver Locky ransomware

Posted on by

An email with the subject of Your Sage subscription invoice is ready pretending to come from Sage but actually coming from a look-a-like domain noreply@sagetop.com  with a malicious word doc attachment  is today’s latest  attempt to deliver Locky ransomware They are using email addresses and subjects that will scare or entice a … Continue reading → Continue reading Your Sage subscription invoice is ready deliver Locky ransomware→

Fake Bank of America Secure Message delivers Trickbot banking Trojan

Posted on by

An email with the subject of Secure email message pretending to come from Bank of America but actually coming from a look-a-like domain Bank of America <message@bofamsg.com>  or Bank of America <message@bofa-msg.com> with a malicious word doc attachment  is today’s latest spoof of a well known company, bank or public … Continue reading → Continue reading Fake Bank of America Secure Message delivers Trickbot banking Trojan→