Posts Tagged ‘zombie’

Rejected ACH payment – Virus/Fraud

Monday, August 15th, 2011

Look out for fraudulent emails spoofing “The Electronic Payments Association” that are arriving as:

From:     risk_manager@nacha.org
Subject:     Rejected ACH payment

In reality these messages are from previously infected personal computers from across the globe:

from [122.168.251.32] (helo=ABTS-mp-dynamic-032.251.168.122.airtelbroadband.in)

These messages include a fictional warning that includes content such as:

The ACH transaction (ID: 32604668345041), recently sent from your checking account (by you or any other person), was rejected by the other financial institution.

more »

New Skype Has Been Releases ! Upgrade Now

Saturday, July 16th, 2011

Mailboxes are now receiving fake Skype upgrade spam sent from hijacked Rhapsody.com mail servers.

The current campaign arrives as:

Subject:     New Skype Has Been Releases ! Upgrade Now
From:     ”Skype” <newsletter@news.skype.com>

In an interesting twist, the spammers involved appear to have hacked and are in control of Rhapsody.com mail servers as the samples we’ve reviewed so far are actually from:

  • mta900.e.rhapsody.com ([63.211.90.40]
  • mta902.e.rhapsody.com ([63.211.90.42]
  • mta903.e.rhapsody.com ([63.211.90.43]
  • mta904.e.rhapsody.com ([63.211.90.44]
  • mta905.e.rhapsody.com ([63.211.90.45]
  • etc., etc.

The spam email itself is as follows:

more »

Notification of Limited Account Access – Paypal Phishing

Wednesday, January 5th, 2011

Paypal users must be easy prey, statistically speaking. Year in and year out, the identity theft Phishing fraud emails just keep targeting them. Once thing is sure, spammers only keep doing what works.

The latest version:

Subject:     Notification of Limited Account Access RXI091
From:     PayPal <security@onlineupdate.com>

more »

Legal Assistance Inquiry – Email Fraud

Friday, October 22nd, 2010

In a previous post, we questioned the competence of the legal profession as follows:

Based on the relatively high volume of email fraud attempts aimed at lawyers, it appears that lawyers are actually worthwhile targets for scams. Otherwise, this type of fraud would be far less frequent.

There must be a flaw in our logic. It turns out that lawyers are masters of due diligence when it comes to email . . . more »

Newegg.com – Payment Changed – Spam Campaign

Thursday, August 26th, 2010

The trend for the summer is for the major botnets to spoof a different brand-name domain every week.

This week’s victim is Newegg.com with large volumes of these bogus emails being sent by infected personal computers (zombies) acting to distribute these “Newegg.com – Payment Change” spoofs.

A typical example comes:

Subject:      Newegg.com – Payment Charged
From:     Newegg <info@newegg.com>

more »

That Ol’ Black (Email) Magic That You Weave So Well

Friday, August 20th, 2010

Yes Virginia, there is Black Magic (BM).

If there wasn’t, nobody would send spam like this:

Subject: cure black magic

From: “batool fatima” <nbhgyt@yahoo.com>

more »

Virus Emails Gone Wild

Wednesday, August 11th, 2010

Apparently the botnets in charge of spreading viruses have decided to go random and wild this week. In an attempt to evade filtering and confuse end user recipients, they’re spewing vast amounts of emails and using a shotgun approach of randomization.

Sending addresses are all random and spoofed and the emails themselves are short and cryptic. Subject lines tend to be short and simple and run the gamut, just a few examples (we’re seeing hundreds of variations):

more »

Welcome to Friendster – Virus/Malware in Disguise

Thursday, August 5th, 2010

Watch out for well designed, but spoofed invitations from Friendster currently making the rounds through spam driven email campaigns.

The samples we’ve reviewed so far arrive as:

Subject:      Welcome to Friendster
From:     Friendster <join@mail.friendster.com>

more »

You’re Invited to Google Mail – Virus & Malware

Monday, August 2nd, 2010

We’re seeing quite the uptick in spoofed “Your Friend has invited you to open a Google mail account” emails lately.

The typical email comes with a subject line and From address such as:

Subject:      Edmond Fletcher has invited you to open a Google mail account
From:     ”Edmond Fletcher” <auntee8@rosesbooks.com>

more »

Amazon.com: Please verify your new e-mail address – Fraud

Tuesday, July 20th, 2010

At least one of the larger spam botnets is hard at work these last few days spreading itself via spoofed Amazon.com emails.

For the most part, these frauds do an excellent job of mimicking legitimate Amazon emails.

The arrive with a Subject line of:

From:      ”Amazon.com E-mail Subscriptions” <delivers@amazon.com>
Subject:     Amazon.com: Please verify your new e-mail address

more »