June 21, 2017

[hr_invisible]

Phish NETS:  No Phish in the Sea; Let’s Go to India…

This was one of those rare weeks in which we didn’t see a single phish.  So we thought we would show our readers two very different malicious emails that share a funny connection to India. It’s this connection that identifies them as being created by the same person and extremely suspicious.

Let’s start with this email using the subject line “Save your marriage from snoring with ASONOR mist!”  Though there is such a product, this email isn’t connected to the real product it claims to represent.  There are so many subtle and not-so-subtle cues in this email that should make a reader suspicious but focus your attention just underneath the “opt out” message at the very bottom of the email.  There you will find the single line of text and a link.  “problem in unsub mail to support @ apexpoint.co.in”   Our long-time readers know that 2-letter country codes are critically important to evaluating the legitimacy or source of online content.  “.in” is the country code for India.  Though we cannot comment on the effectiveness of a spray that claims to stop snoring (…but we role our eyes at any claim that says it is “revolutionary”),  we have to ask ourselves why this email would ask anyone to contact a service in India if you have trouble “unsub”-ing.

[hr_invisible]

Some readers may think that we are overzealous and see a threat behind every online/smartphone contact and we need to chill out.  Afterall, to a hammer, all the world looks like a nail.  But this is our purpose, to educate fellow Netizens…. Take this next email with the subject line “You’ve gotta check this out… (2 days left)” that came from the domain daillyyofr-DOT-bid.   You might immediately notice that the global top level domain is the unusual “bid” and similar to the email above.  But before checking out this 50% off offer that seems to be from ProFlightSimulator.com, look at the very bottom of the email, below the opt-out line…

[hr_invisible]

Once again, but this time with “problem” misspelled, we find “Problam in unsub mail top [instead of mail to] support @ apexpoint.co.in.  Coincidence?  We think not.  We used Screenshot Machine to show us a picture of what waits for us at the link for the “stop snoring” email above and we were shown a picture of a Google look-alike page written in Slavic languages. (See below.) How do you feel about clicking these two links and buying those products now?  Yeah, us neither.

[hr_invisible]

YOUR MONEY:  Coolest Gifts for Dad, Attention Veterans, New Store Voucher From Costco

It’s also important to remember that criminals often target people with malicious emails that seem tied to holidays and celebrations, such as the recent Father’s Day.  Here’s an email  with the subject line “Coolest Gifts For Dads.”  We’re both dads and we don’t agree with them when they say “The Gift Every Dad Wants” but hey, we’re not every dad.  The links in this email point to kind.lsyne-DOT-us/dad-gift.  “kind” is a subdomain of the domain lsyne.  The Zulu URL Risk Analyzer informs us that this link will forward you to tacticalgadget.com, but after installing malware on your computer.  It gave that link a rating of 100% malicious!

Deeeleeeete!

[hr_invisible]

“Attention Veterans: Government programs can reduce monthly mortgage payments” Have you served our country?  Then PLEASE don’t click this link!  Once again, the Zulu URL Risk Analyzer nails this as 100% malicious!  This email has nothing to do with VA Benefits.

[hr_invisible]

Fortunately, this poorly created bogus email from wearecostko-DOT-com is not likely to fool too many people.  Costko?  Seriously?  “New store voucher from Costo – Activate here”  We couldn’t figure out what the heck “Prin” meant in the clickable link “Prin Reward Here” and decided to throw it into Google Translate to see if anything turned up.  It turns out that “prin” means “by” in Romanian.  Hmmmm…..  And of course the domain wearcostko-DOT-com was registered by someone named Darrell Lemley on the day the email was sent.

Delete.

[hr_invisible]

[hr_invisible]

TOP STORY:  Typos That Hurt: Another Microsoft Tech Support Scam

Very recently we received a call from a friend who sat down at his PC to log into his Gmail account.  Typing at the keyboard quickly, and without looking carefully, he clearly entered something other than gmail.google.com.  Suddenly his large screen filled with pornographic images and two messages informing him he had been hit with the Zues virus.  He was told to call a Microsoft tech support help line.  Fortunately, the messages provided the phone number he was supposed to call.

The messages stated emphatically…. “Windows Defender Alert: Zeus Virus Detected on your Computer!  Please do NOT SHUT down or reset your computer.  The following data will be compromised if you do so:

– Passwords  [TDS: NOT TRUE!] – Browser History  [TDS: who cares…] – Credit Card Information  [TDS: NOT TRUE!] – Local Hard Disk Files   [TDS: NOT TRUE!]

[hr_invisible]

Here’s what really happened.  Our friend clearly mistyped something and went to a domain designed to take advantage of a typo.  That domain, whatever it was, redirected him to a web page at criticaldefaulterrorx02158-DOT-com. (As in critical default error)  This page pulled in porn images and was designed to fill his screen with them, while adding two popups containing the messages about the Zeus virus.  The intent was clear.  Shock someone into calling the number on the screen for help even though the easiest way to clear this problem is to force quit the web browser, relaunch and clear the browser’s cached files of the nasty popup and redirects.

The phone number listed (877-640-2280) may be a toll-free 877 number but a Google search shows no connection whatsoever to Microsoft.  Similar Zeus virus scares have been reported in the past to trick people into calling and paying for tech support services.  Here are links to a few articles about this scam:

Fake Zeus Virus Warning (May, 2017)

How to Remove “Windows Detected Zeus Virus” Scam (May, 2017)

“Zeus Virus Detected”: Windows Defender Alert scam removal (May, 2017)

If you ever get a startling message in a web browser telling you to call tech support.  Quit your program!  If you can’t do that, then shut down your computer!  Once you are back up, scan for malware or viruses using your trusted anti-virus software.

[hr_invisible]