Category Archives: macro virus

random company invoice – word doc macro malware

Posted on by

Last revised or Updated on: 28th March, 2016, 4:30 PMAn email with the subject of [random company name] invoice – [recipient domain]  pretending to come from random senders  with a malicious word doc or Excel XLS spreadsheet attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. This series of malspam emails has a … Continue reading → Continue reading random company invoice – word doc macro malware→

Sixt Invoice: 0252056792 from 24.03.2016 – word macro malware

Posted on by

Last revised or Updated on: 24th March, 2016, 4:23 PMAn email with the subject of Sixt Invoice: 0252056792 from 24.03.2016 ( random numbers)   pretending to come from random names, companies and email addresses with a malicious word doc attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Sixt car rental  sixt.com has … Continue reading → Continue reading Sixt Invoice: 0252056792 from 24.03.2016 – word macro malware→

Axminster Tools & Machinery Your order has been despatched – word macro malware

Posted on by

Last revised or Updated on: 24th March, 2016, 10:49 AMAn email with the subject of Your order has been despatched pretending to come from customer.service@axminster.co.uk with a malicious word doc  attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Axminster Tools & Machinery http://www.axminster.co.uk  has not been hacked or had their email or other … Continue reading → Continue reading Axminster Tools & Machinery Your order has been despatched – word macro malware→

your latest electronic invoice from D.E. Web Works – word doc rtf macro malware

Posted on by

Last revised or Updated on: 23rd March, 2016, 12:59 PMFollowing on from this malspam run yesterday is today’s similar run with  emails with the same subjects  pretending to be your latest electronic invoice from D.E. Web Works   with a malicious word doc RTF attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. D.E. … Continue reading → Continue reading your latest electronic invoice from D.E. Web Works – word doc rtf macro malware→

Urgent: F184255 SAFESTORE HLDGS PLC/ HPE STRAN Technologies – word doc macro malware leads to #Dridex

Posted on by

Last revised or Updated on: 22nd March, 2016, 4:44 PMFollowing on from THIS malspam run this morning with almost identical subjects is an email with the subject of Urgent: F184255 SAFESTORE HLDGS PLC/ HPE pretending to come from random names and email addresses  with a malicious word .doc and an .RTF  attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better … Continue reading → Continue reading Urgent: F184255 SAFESTORE HLDGS PLC/ HPE STRAN Technologies – word doc macro malware leads to #Dridex→

Hewlett Packard Enterprises random company names Urgent document – word RTF macro malware leads to Dridex

Posted on by

Last revised or Updated on: 22nd March, 2016, 11:00 AMAn email that appears to come from HP ( Hewlett Packard Enterprises) with the subject of Urgent: F400572 HARGREAVES LANSDOWN PLC/ HPE coming from random names and email addresses   with a malicious word doc RTF attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers … Continue reading → Continue reading Hewlett Packard Enterprises random company names Urgent document – word RTF macro malware leads to Dridex→

Blank 2 Steve Gale – word macro malware leads to #Dridex

Posted on by

Last revised or Updated on: 22nd March, 2016, 9:34 AMAn email with a completely blank / empty body with the subject of  Blank 2 pretending to come from Steve Gale <steve1gales@gmail.com>  with a malicious word doc or Excel XLS spreadsheet attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Steve Gale or … Continue reading → Continue reading Blank 2 Steve Gale – word macro malware leads to #Dridex→

FW: Notification from random company name – word doc rtf macro malware

Posted on by

Last revised or Updated on: 18th March, 2016, 4:31 PMFollowing on from this post is an email with the subject of  FW: Notification from [random company name] pretending to come from random names and email addresses  with a malicious word doc rtf attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. some … Continue reading → Continue reading FW: Notification from random company name – word doc rtf macro malware→

UKMail Customer Services Proof of Delivery Report: 16/03/16-17/03/16 – word doc macro malware leads to Dridex

Posted on by

Last revised or Updated on: 18th March, 2016, 10:18 AMAn email with the subject of  Proof of Delivery Report: 16/03/16-17/03/16 pretending to come from UKMail Customer Services <list_reportservices@ukmail.com>  with a malicious word doc or Excel XLS spreadsheet attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The email looks like: From: UKMail … Continue reading → Continue reading UKMail Customer Services Proof of Delivery Report: 16/03/16-17/03/16 – word doc macro malware leads to Dridex→

Invoice DOINV32142 from Tip Top Delivery – word RTF malware leads to Dridex

Posted on by

Last revised or Updated on: 17th March, 2016, 5:34 PMAn email with the subject of  Invoice DOINV32142 from Tip Top Delivery ( random characters)   pretending to come from  random email addresses with a malicious word doc RTF attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The email looks like: From: random … Continue reading → Continue reading Invoice DOINV32142 from Tip Top Delivery – word RTF malware leads to Dridex→