Collaborate Disseminate
An email pretending to be an invoice coming from random senders with a PDF attachment that drops a malicious macro enabled word doc that should deliver some sort of malware This looks like a continuation of last week’s big malspam run that delivered a new ransomware Jaff ransomware but at this time because … Continue reading → Continue reading more fake invoice malspam with pdf attachments deliver malware
An email with the subject of Scanned image coming or pretending to come from random email addresses with a pdf attachment that contains an embedded malicious word doc delivers jaff ransomware This looks like a continuation of yesterday’s big malspam run that delivered a new ransomware Jaff ransomware This particular malspam run started … Continue reading → Continue reading Scanned image malspam with pdf attachment delivers jaff ransomware
Continuing with today’s Ursnif /Gozi /ISFB banking Trojans. This one is using a different delivery method to try to throw us off track. Whereas today’s earlier ones spoofing DHL [1] [2] used standard .js files inside zips, this has a word docx attachment that contains an embedded ole object that … Continue reading → Continue reading Ursnif banking Trojan delivered by fake invoices using word docs with embedded ole objects
An email with the subject of Secure Message pretending to come from RBS Royal Bank of Scotland but actually coming from a look alike domain Royal Bank of Scotland <no-reply@rbs-secure-message.co.uk> with a malicious word doc attachment is today’s latest spoof of a well known company, bank or public authority delivering Trickbot banking Trojan … Continue reading → Continue reading fake Royal Bank of Scotland Secure Message delivers Trickbot banking Trojan
Nothing special about the emails that are delivering this malware version. It is a typical well used email template with subjects varying from with literally hundreds if not thousands of subjects. These generally deliver either Locky ransomware or Dridex banking Trojan File_69348406 PDF_9859 Scan_2441975 Document_11048 Copy_9762 They all have … Continue reading → Continue reading more malware via embedded word macro docs in pdf attachments
An email with the subject of Important BACs Documents pretending to come from Lloyds Bank but actually coming from a look-a-like domain <secure@lloydsbankdocuments.com> with a malicious word doc attachment is today’s latest spoof of a well known company, bank or public authority delivering Trickbot banking Trojan They are using email addresses … Continue reading → Continue reading fake Lloyds Bank Important BACs Documents malspam delivers Trickbot banking Trojan
This next malware delivery attack was sent to me by a contact, so I can alert about this one. I totally agree with him that the original email is extremely difficult to completely block ( especially in the early stages of a malspam run ) and trying to prevent users from opening … Continue reading → Continue reading Open the attachment to view the document malspam delivers a multitude of malware
An email with the subject of Secure email message pretending to come from Companies House but actually coming from a look alike domain <noreply@cp-secure-message.co.uk> with a malicious word doc attachment is today’s latest spoof of a well known company, bank or public authority delivering Trickbot banking Trojan They are using email … Continue reading → Continue reading Fake Companies House Secure email message malspam delivers Trickbot banking Trojan
An email with the subject of Secure email communication pretending to come from HM Revenue & Customs <GSRPCommunication@govsecure.co.uk> with a malicious word doc attachment is today’s latest spoof of a well known company, bank or public authority delivering Trickbot banking Trojan They are using email addresses and subjects that will scare or entice … Continue reading → Continue reading More Trickbot banking Trojan delivered by fake HMRC Secure email communication malspam emails
An email with the subject of Secure email communication pretending to come from ScotiaBank <Secure.Mail@scotiabankmail.com> with a malicious word doc attachment delivers what looks like Trickbot banking Trojan They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion … Continue reading → Continue reading spoofed Scotiabank Secure email communication delivers Trickbot banking Trojan