Fake Royal Bank of Scotland you owe service charges of £42,243.52 tries to deliver trickbot

This example is an email containing the subject of “Advice of Service Charge” saying that you have a service charge to pay of £42,243.52 is really going to give a few recipients quite a shock.  This pretends to come from RBS, Royal Bank of … Continue reading Fake Royal Bank of Scotland you owe service charges of £42,243.52 tries to deliver trickbot

Fake Danske Bank “FW: Insurance Documents” delivers Trickbot

Yet another pretty lame email from the Trickbot gang again today. Some days I really don’t understand this gang of criminals. They go to the bother of registering various look-a-like domains to send the emails from, so they might stand a better chance … Continue reading Fake Danske Bank “FW: Insurance Documents” delivers Trickbot

Trickbot delivered via Fake HSBC Payment Advice using activeX controls in word macros

Another pretty lame email from the Trickbot gang again today. Some days I really don’t understand this gang of criminals. They go to the bother of registering various look a like domains to send the emails from, so they might stand a better chanc… Continue reading Trickbot delivered via Fake HSBC Payment Advice using activeX controls in word macros

fake Companies House eReminder Service delivers Trickbot

This example is an email containing the subject of “Urgent Action is required. – Companies House eReminder Service ” pretending to come from ereminders@companieshouse.gov.uk  but actually coming from “DoNotReply@gov-delivery.uk&… Continue reading fake Companies House eReminder Service delivers Trickbot

False Invoice Due email with password protected attachment delivers malware

This generic email with the subject of “Invoice Due”  coming from  help@simplexhealthcare.info with a malicious password protected word doc attachment  does eventually deliver some sort of malware. Recently password protected word docs have… Continue reading False Invoice Due email with password protected attachment delivers malware

Fake HMRC “Submission 5DW8 F36N MG2A 9HJ not processed ” delivers trickbot

Today’s Trickbot campaign is a pretty lame example from this prolific malware gang. The email containing the subject of “Submission 5DW8 F36N MG2A 9HJ not processed ” pretending to come from noreply.taxreg@notifications.hmrc.gov.uk  b… Continue reading Fake HMRC “Submission 5DW8 F36N MG2A 9HJ not processed ” delivers trickbot

Fake “You have received a Secure Doc message from Citi Secure Email Server” delivers Trickbot

This example is an email containing the subject of ” You have received a Secure Doc message from Citi Secure Email Server ” pretending to come from Citi Group but actually coming from “noreply@securemailcenter-citigroup.com” whi… Continue reading Fake “You have received a Secure Doc message from Citi Secure Email Server” delivers Trickbot

Fake “Scanned from a Xerox Multifunction Printer ” delivers Trickbot

Yet another change to the Trickbot Banking Trojan distribution system again today. Today the Trickbot gang are pretending  that a scanner or multifunction device is emailing you a  scanned document. We used to see this lure all the time from other malw… Continue reading Fake “Scanned from a Xerox Multifunction Printer ” delivers Trickbot

Fake HMRC “Critical Notice: Statement of Liabilities” delivers Trickbot

This example is an email containing the subject of “Critical Notice: Statement of Liabilities” pretending to come from HMRC but actually coming from “service@hmrcemail.co.uk” which is a look-a-like,  typo-squatted or other domai… Continue reading Fake HMRC “Critical Notice: Statement of Liabilities” delivers Trickbot