Odd Phishing?

Author
Discussion

Mr Scruff

Original Poster:

1,332 posts

215 months

Tuesday 25th April 2017
quotequote all
I've received a dodgy looking email in my 'signup to list' email account. Normally I'd just delete, however this one is a little more interesting as it contains my full name and address.

Email body is:

Claim (and then a claim number starting with MV)
My name
My full address and postcode

Followed by

"I look forward to hearing from you" and a name.

Other thing that's a little different is that the name on the email actually matches the email address (which is a club-internet.fr address).

The email has an attachment, which is a zip file containing a password protected Word doc - password is in the email body. I've scanned the file with various virus scanners and nothing has pinged but the document contains macros which I'm not going to enable.

Anyone come across anything similar?

_dobbo_

14,376 posts

248 months

Tuesday 25th April 2017
quotequote all
Phishing scams are getting more and more sophisticated - as people become more savvy the attempts will continue to do so.

The recent punycode one for example was pretty terrifying, read about it here if such things interest you. I challenge even the most security conscious user not to potentially get caught out by one like this:

https://www.wordfence.com/blog/2017/04/chrome-fire...




dudleybloke

19,819 posts

186 months

Tuesday 25th April 2017
quotequote all
I had similar today. I think they have got my details off eBay as I made a minor mistake with my details on ebay and its got the same mistake in this email.
Filed under spam now.

Mr Scruff

Original Poster:

1,332 posts

215 months

Tuesday 25th April 2017
quotequote all
dudleybloke said:
I had similar today. I think they have got my details off eBay as I made a minor mistake with my details on ebay and its got the same mistake in this email.
Filed under spam now.
Good to know, done the same, thanks.



ging84

8,897 posts

146 months

Tuesday 25th April 2017
quotequote all
If there is malicious code embedded in an encrypted file no virus scanner is going to be able to detect it until it's decrypted, and since with a protected word document that is done at the point of opening it may be too late at that point, this is why they have protected a document, and included the password to unlock it in the very same email.

How many times do you think you have been told
If someone sends you an unsolicited email, if there is an attachment, don't open it, if there is a link, don't click it, this sort of thing is why.

optimate

109 posts

84 months

Tuesday 25th April 2017
quotequote all
there's plenty of zero day exploits in word some still unpatched by Microsoft to execute code

as for relying on anti virus good luck with that

the average script Kiddy can bypass AV software in about 30seconds with very little knowledge

CoolHands

18,630 posts

195 months

Tuesday 25th April 2017
quotequote all
Bloody hell don't open the attachment. Unless your at work, obvs.

55palfers

5,909 posts

164 months

Wednesday 26th April 2017
quotequote all
dudleybloke said:
I had similar today. I think they have got my details off eBay as I made a minor mistake with my details on ebay and its got the same mistake in this email.
Filed under spam now.
I've had several of these too.

How did they get the data from eBay? When did they get hacked?

optimate

109 posts

84 months

Wednesday 26th April 2017
quotequote all
nearly every email provider has been hacked at one point weather they admit or not

talktalk
hotmail
gmail
yahoo
gmx mail

to name but a few
most of that data ended up sold on dark web epecily combos of user names and passwords

and now to script kiddys on open net.

people are lazy and often use same password for every thing

one of the script kiddys favorite pass times at the moment
is using sentry mba and said combos to test then user names and passwords against any usefully sites / accounts automatically then come back later and sell or plunder anything useful or of value