Category Archives: Macro

Fake Santander Bank Important – New Account Documents delivers Trickbot banking Trojan

Posted on by

An email with the subject of Important – New Account Documents pretending to come from Santander Bank  but actually coming from a look-a-like domain Santander <account.documents@santanderdoc.co.uk> or Santander <account.documents@santandersec.co.uk>   with a malicious word doc attachment  is today’s latest spoof of a well-known company, bank or public authority delivering Trickbot banking Trojan … Continue reading → Continue reading Fake Santander Bank Important – New Account Documents delivers Trickbot banking Trojan→

Trickbot banking Trojan continues to be delivered by spoof NatWest bank messages

Posted on by

The Trickbot gang have got a bit lazy today and continued with imitating NatWest Bank and using the same look-a-like domain as yesterday’s version. But using a slightly different email message. They have even re-used the same domains to deliver the actual payload, but with different file names. An email … Continue reading → Continue reading Trickbot banking Trojan continues to be delivered by spoof NatWest bank messages→

Fake Your Sage subscription invoice is Due delivers malware

Posted on by

An email with the subject of Your Sage subscription invoice is Due pretending to come from Sage but actually coming from a look-a-like domain SAGE UK <message@sagemailsupport14.top>  with a malicious word doc attachment  is another one of today’s  spoofs of a well-known company, bank or public authority delivering what I think … Continue reading → Continue reading Fake Your Sage subscription invoice is Due delivers malware→

More fake NatWest emails deliver Trickbot banking Trojan

Posted on by

An email with the subject of Secure email message pretending to come from NatWest bank  but actually coming from a look-a-like domain noreply@ servicemessage###.ml  with a malicious word doc attachment  is today’s latest spoof of a well-known company, bank or public authority delivering Trickbot banking Trojan. The ### is any number between … Continue reading → Continue reading More fake NatWest emails deliver Trickbot banking Trojan→

More fake Lloyds Bank Important – Protected Documents malspam delivering Trickbot banking Trojan

Posted on by

An email with the subject of Important – Protected Documents pretending to come from Lloyds Bank  but actually coming from a look-a-like domain Lloyds Bank <donotreply@lloydsbankprotected.com> or Lloyds Bank <donotreply@lloydsbankprotected.co.uk>  with a malicious word doc attachment  is today’s latest spoof of a well-known company, bank or public authority delivering Trickbot banking Trojan … Continue reading → Continue reading More fake Lloyds Bank Important – Protected Documents malspam delivering Trickbot banking Trojan→

Fake Lloyds Bank You have a new secure Message malspam delivers Trickbot banking Trojan

Posted on by

An email with the subject of You have a new secure Message pretending to come from Lloyds Bank  but actually coming from a look-a-like domain Lloyds Bank <message@lloydsbankmsg.com> or  Lloyds Bank <message@lloydsbank-msg.com> or Lloyds Bank <message@lloydsbankmsg.co.uk>  and to make up a full house of possible combinations we also have Lloyds Bank <message@lloydsbank-msg.co.uk>  with … Continue reading → Continue reading Fake Lloyds Bank You have a new secure Message malspam delivers Trickbot banking Trojan→

Your Sage subscription invoice is ready deliver Locky ransomware

Posted on by

An email with the subject of Your Sage subscription invoice is ready pretending to come from Sage but actually coming from a look-a-like domain noreply@sagetop.com  with a malicious word doc attachment  is today’s latest  attempt to deliver Locky ransomware They are using email addresses and subjects that will scare or entice a … Continue reading → Continue reading Your Sage subscription invoice is ready deliver Locky ransomware→

Fake Bank of America Secure Message delivers Trickbot banking Trojan

Posted on by

An email with the subject of Secure email message pretending to come from Bank of America but actually coming from a look-a-like domain Bank of America <message@bofamsg.com>  or Bank of America <message@bofa-msg.com> with a malicious word doc attachment  is today’s latest spoof of a well known company, bank or public … Continue reading → Continue reading Fake Bank of America Secure Message delivers Trickbot banking Trojan→

Fake Companies House Company ID : XXXXX391 malspam delivers Trickbot banking Trojan

Posted on by

An email with the subject of Company ID : XXXXX391 pretending to come from Companies House but actually coming from a look-a-like domain Companies House <message@companieshouseemail.uk>   or  Companies House <message@companieshousemail.uk> with a malicious word doc attachment  is today’s latest spoof of a well known company, bank or public authority delivering Trickbot … Continue reading → Continue reading Fake Companies House Company ID : XXXXX391 malspam delivers Trickbot banking Trojan→

Fake Barclays bank Ref: 72381821 delivers Trickbot banking Trojan

Posted on by

An email with the subject of Ref: 72381821 pretending to come from Barclays Bank but actually coming from a look-a-like domain Barclays <message@barclaysmail.co.uk> or Barclays <message@barclays-mail.co.uk> with a malicious word doc attachment  is today’s latest spoof of a well known company, bank or public authority delivering Trickbot banking Trojan They are using … Continue reading → Continue reading Fake Barclays bank Ref: 72381821 delivers Trickbot banking Trojan→