November 15, 2017

[hr_invisible]

Phish NETS: Netflix, Bank of America, PayPal and Amazon

This phish pretends to be from Netflix but it is easy to see through it if you just look at the sender’s email or mouse-over the link for “Update Now.”  The email was sent from France (“.fr” = 2-letter country code for France).  Lame.  And besides, anyone who tells you they are having trouble authorising your Credit Card had better identify you by name and give you the last 4 digits of that card!  This phish is trying to capture your credit card information.  By the way, the link will send you to a website in Thailand. (“.th” = 2-letter country code for Thailand.)

Just delete.

This Bank of America phish is equally as lame.  “Dear Valued Customer, You have an incoming payment stated from your Checking account.”  Awkward English! Read the email and you’ll find multiple instances of awkward English.  The from address is actually from Northwest Missouri University.  The link for bankofamerica.com/online actually points to a hacked website in Germany that is written in Persian!

“Dear Member, your account will be limited” says an email from the fictional domain inside.paipalcom.  No such domain exists.  The link “Click here to activate your account” points to the link shortening service ow.ly.  We unshortened that link to find that it will send you to a hacked website for the Oklahoma Public School Resource Center.  (We’ve notified them.)  Below you can see the fake PayPal login waiting for you there.

[hr_invisible]

[hr_invisible]

Finally, here’s another Amazon scam sent to us by one of our sharp-eyed readers!  But, truth be told, we’re not sure if it is a phish or just social engineering trick sending you to malware.  We have been unable to get our tools to give us any information about the destination of the link “View or manage order.”  …Other than the fact that it points to an obvious subdomain for a hacked Ophthalmic office website in Peru.  Our reader’s eyes were good enough to spot this fraud so we think we’ll just move on….

[hr_invisible]

[hr_invisible]

YOUR MONEY: Huge Thanks from Costco, Pandora 80% off, and Amazon Prime Survey

We LOVE the effort the criminals are making in this next malicious email “A huge thanks from Costco.”  Look at the from address carefully.  It came from costKorewards.com!  “Cammie Macpherson” registered that domain on the day the email was sent and is hosting it in Istanbul, Turkey.  We’ve found many other malicious domains registered by “Cammie.”   The domain was registered through NameCheap.com, a favorite registrar used by criminal gangs lately.  Why they can’t see the obvious fraud in a domain name like costkorewards.com is beyond us.

Do you like Pandora jewelry?  Want a chance to purchase it at 80% off?  This is not that chance.  It’s just click bait.  The links all point to a hacked website for an antiques dealer in France.  Malware waits for you there, not Pandora jewelry.

The same TDS Reader who sent us the Amazon scam also sent us this click-bait.  Look carefully at the from address.  Is this for Amazon or Sears?  The criminals most likely re-used a Sears scam email and forgot to change the from information.  “Take a survey about Amazon to get a FREE GIFT!”  Errrr…. No thanks.  The link to Poland (”.pl”= 2-letter country code for Poland) is scary enough by itself.

[hr_invisible]

[hr_invisible]

TOP STORY: Tricks to Infect Apple Computers

We remind Apple computer owners that they are not immune to the malware that targets the Windows operating system.  During the last few weeks we have seen an increase in the number of malicious emails and tricks that are specifically targeting Apple computer owners and we made this point in last week’s Your Money column called “Detox My Mac.”

In the past week we saw more tricks targeting Mac owners.  Doug at The Daily Scam was visiting a well known news website when this gem popped up!  “Please Install Media Player To Continue (Recommended) Installing takes under a minute – No restart is required”  How convenient!  Notice the domain name connected to this helpful “Media Downloader”…  cdn-DOT-nylondigital-DOT-win. This bogus domain was registered on October 29 using NameCheap (again!) but through a private proxy service in Panama.  This popup has bad mojo all over it.

Doug wondered what website had been hacked and was responsible for this poison pill.  Here is a screenshot of the most recent history that lead to the popup poop…

At 7:06 pm he got hammered from three very suspicious domains (spotscenered-DOT-info, plaimedia-DOT-com, and solidcpm-DOT-com)  And if you look at the above screenshot carefully, you’ll see that Doug was on CNN.com when this happened.  Ouch!  Either CNN or one of their advertisers/services got hacked and manipulated.  In any case, DON’T install software because a popup tells you to!  Here’s what VirusTotal said about the domain nylondigital-DOT-win:

Another type of social engineering targeted iPhone users last week.  On November 8 and 9 our honeypot servers were hit with hundreds of emails that were spoofed to look like they came from Soul Electronics from California.  They did not.  The real Soul Electronics even has a warning about these emails here. This email even included a copy of YOUR supposed email to them that you sent the day before…  “RE: iPhone X pre-order”  “good morning , we have managed to ship your iPhone.  Here is the USPS tracking info”  But that tracking info doesn’t point to the USPS website as shown.  A mouse-over reveals that it points to a website called captainspeedy-DOT-com.  And it is 100% malicious with malware waiting to attack your computer.

[hr_invisible]

So, you Apple owners… Want to sleep better at night?  Understand that you are targeted too!  Get yourself some solid Anti-virus/Anti-spyware software installed on your desktops/laptops, such as Sophos.

[hr_invisible]