August 30, 2017

[hr_invisible]

Phish NETS:  SunTrust Bank, Microsoft Office 365, PayPal, Bank of America, and Apple ID

When it rains, it pours!  Let’s start with SunTrust Bank.  Look carefully at this email that appears to come from secure@suntrust.com.   The from address was expertly spoofed.  “Account Temporarily Suspended”  “As part of our security measures, we regularly screen activity in suntrust Online Banking System….”  The grammatical and spelling errors in this email are subtle.  Can you spot them?  A mouse-over of the link “suntrust.com” reveals a link to a shortened URL at bit.ly…

[hr_invisible]

We used Unshorten.it to see that the victim will be redirected to a pet food website in Israel.   Not wanting to risk a possible malware infection, we used Screenshot Machine to peek at the page.  We weren’t surprised.

Look below!

[hr_invisible]

During the three years we’ve been in operation, we’ve never seen a phishing scam trying to capture credentials for Microsoft Office 365.  But we caught this phish just a few days ago!  At first we thought it was simply a malicious email until we followed the breadcrumbs.  “Due Invoice Wire sent” seems to come from Microsoft but, in fact, it doesn’t.  The from address was spoofed.  A mouse-over reveals that the links in this email point to a server in India called “akhienterprise-DOT-in”.  Look below at the web page that waits for your arrival.  It conveniently included the user’s email address for login purposes too.

Deeeeleeeete!

[hr_invisible]

And then there were these three lame emails phishing for your login credentials to PayPal, Bank of America and Apple.  The PayPal email had an attached html file that is very dangerous to open!  The other two contained links to far-off websites.  The Bank of America email was sent from an address in Romania. (.ro = 2-letter country code) and contains a link to a server in Columbia. (.co = 2-letter country code)  The email pretending to be from Apple was clever because the scammers made their link look like a secure link (https) with a token (code) for identifying your account.

Delete, delete, delete!

[hr_invisible]

[hr_invisible]

[hr_invisible]

YOUR MONEY:   Auto Warranty Network, Used Car Inventory and Summer Specials on AC Replacements

There seems to be one criminal gang that is most responsible for the majority of malicious emails disguised as consumer products.  We make this claim because so many of them show the same design, layout, underlying html code and domain naming tricks.  Take these three…  The first came from AutoWarrantyNetwork “@” itrfjfn-DOT-website.  Notice that it appears to be a random set of letters following the “@” symbol and before the top level domain “website.”  That domain, itrfjfn-DOT-website, was registered by someone named Stephanie Savage from Louisiana on the day email was sent.  And the website is being hosted in Bucharest, Hungary. Notice the hidden text at the bottom of the email?  Most of our readers know that criminals include it hoping that it will trick anti-spam servers into thinking the email is legitimate.  (Thankfully, that rarely ever works.)

“A used car may let you skip the state sales tax.”  “Get an affordable used car without hassles.” Even though this next email seems to have been sent from caroption.com, a domain registered way back in 2003, don’t believe it!  Links in the email point to a webserver identified as direv-DOT-download. This domain was registered using a private proxy service in Panama on the day the email was sent.

Delete!

There are sooooo many reasons to throw out this next email about “summer specials for A/C replacements” starting with the fact that the domain, acsavings-DOT-com, is listed for sale and Google finds no such website.  Or the hidden text at the bottom of the email, or the tech support contact link pointing to India, or that Google maps cannot find the address on Pallet Street that is listed at the bottom of the email, or the fact that the links point to a domain (costguid-DOT-bid) that was registered minutes before the email was sent.

Blah, blah, blah… Just delete and move on…

[hr_invisible]

[hr_invisible]

TOP STORY:  Take The Survey Now!

In our market-driven economy it isn’t uncommon for businesses to conduct a market analysis and pay people to take a survey or evaluate products.  This is exactly what these malicious emails are trying to take advantage of.  Take the survey now and earn $50.  “You have been selected to take part in an Anonymous Survey about CVS!” says the first email from RewardCheck @ celloway-DOT-stream.  Who wouldn’t jump at the chance to take a 30 second questionnaire and earn $50?  But at the other end of this link is malware, and statistically speaking, it is most likely ransomware that will lock up your computer and cost you hundreds of dollars to unlock it.  The Zulu URL Risk Analyzer took only seconds to determine that the link in this email is 100% malicious.

Do you feel like you’ve seen this next one before?  “You have been selected to take part in our anonymous survey about Amazon” says an email from GrabYourGift @ navalane-DOT-stream.  “Take this 30 second questionnaire and we’ll offer you an exclusive reward worth over $50.” Bull patties!  This landmine came from the same creators of the CVS lure above.  As did the final email below that was sent from “TargetWinner @ MotorCrane-DOT-stream” and wants you to believe it came from the store Target.

[hr_invisible]

It’s obvious, once again, that deceipt online is rampant and easy.  Which is why we continually emphasize how very important it is to keep a healthy dose of skepticism and check on the authenticity of content before clicking!

[hr_invisible]