It has a Word document attachment that is identified as infected by Gmail likely very similar to what youve documented here. asking me to visit a website to track a delivery for an order I have not placed from a company. Somehow, this sounds less suspicious that enabling macros, as though youre just agreeing to view whats inside the document, not trusting it to the point of letting it run untrusted program code inside Word. To get you to agree to run their malicious macro program, the crooks use what you might call a bait-and-switch trick. My wife got one of these using s form of her name that is as far as we know only used on her eBay account. So it feels wrong and risky not to open it to see how much is in there. To make matters worse, Microsoft actually does ask you to log in to turn on the edit function if you have their Android view only version of Word. But because theyve used a rather odd variant of my name, I know they got the data from ebay (or an ebay seller). If they are, theyll tell you they areand if they arent, theyll still tell you they are . With most calls I receive, this works on about 75% of them. Noticed that a lot of malware does this- why? Thanks. Good article. Since most people have their personal information on social media and data collection sites, it would be easy to find an e-mail address, either through a data breach or just searching. If there is, then it could be the malwarea good hint is if it has a timestamp that matches the moment when you opened the DOT file. I think its because since malware is run inside a windows virtual machine, these requests to windows update are legitimate. Even if the document claims to be an invoice you dont owe, or threatens you in some way, dont let fear or uncertainty get the better of you. But in this case, the email wasnt trying to disguise that it came from a neer-do-well. Domain of the sender was some german company I have no connection to. It certainly wouldnt have the work address of a spouse in it. I have just received one of these, the address , county and postcode were all spot on. If you dont do that then the macros just lie around in memory but never get executed, so no harm done. Even if you opened the attachment then you are probably fine as long as you did *not* also do these: * Enter the four-digit passsord from the email. DOT files can have macros in them, thats why the .DOT was used. Robocalls that hang up immediately are usually meant to verify your number. They will simply tell you what they want you to hear, not what you need to know. How can you report this? Same here but in addition, they had my mobile number (new number) !!!! All recipients were in the UK only. I deleted it. You could also look by hand in your TEMP folder, see if there is a file with a name of consisting of a few numeric digits followed by .EXE. And if youre a friend who gets asked for help, try using our short-and-sweet motto, and stick to your guns: Dont buy, dont try, dont reply.. At least in the UK, many companies that collect addresses put them through some kind of standardisation algorithm to produce address data in the format preferred by the Post Office, so it can be hard to figure out the likely source of the breach. Problem is the company does exist but is in the US. As an aside: if you are ever concerned about the legitimacy of an email (or a text message, IM, phone call, etc.) Paul, if you are reading this, check my forward from e-mail address in the last two weeks, to your is-spam@labs.sophos.com address. Header looks ok, so I think sender account has been hacked. document.getElementById( "ak_js_1" ).setAttribute( "value", ( new Date() ).getTime() ); 24/7 threat hunting, detection, and response delivered by an expert team as a fully-managed service. If so, you can download our free Sophos Virus Removal Tool to search for malware that may be lurking undetected. Never ask the sender of the email for advice. I think thats a safe assumption. If you do open the attachment, which is portentously called Yoursurname.dot, Word prompts you for a password, just as the scammers warned you to expect: The password is randomly chosen for each recipient, and you really do need to use the one in your own email to open the file: At this point, the crooks are aiming to persuade you to enable macros in the open document, which means youll be running program code stored in the file by the crooks themselves. Until you do that the document is technically not open its just scrambled data, including scrambled macro code that cant run. Many UK residents woke up yesterday to a rude internet shock: a scam email that greeted them with their real name and home address. If that message doesnt appear, the macro code to fire up the downloaded malware probably didnt work properly. A check of haveibeenpwned.com for those recipients indicates no common data breach. A breach of your data by company X doesnt put just your account with X in jeopardy it probably puts your accounts with other organisations at risk too. Assume I am OK as long as I didnt open the attachment on my PC? Dont get caught out by the Tinder scammers, The scam that knows your name and home address heres what to do, UBER HAS BEEN HACKED, boasts hacker how to stop it happening to you, URGENT! Doubt it. Thats my understanding: a subset of the data in the electoral register is always public, and the rest of it is openly sold by HM Government unless you opt out. Of course, the scrambling also means that the fake GIF file is harmless on its own, so the malicious macro includes a decryption loop that strips out the executable code, unscrambles it and writes it to %TEMP%, the special folder where Windows saves your temporary files. It means that the machine wants to confirm that the number is active and that a real person answered the phone. Because of the emails it was sent to and the address details we can work out it is data that only eBay was holding. Zoom for Mac patches sneaky spy-on-me bug update now. So names and addresses dont need to originate from a data breach when the info is sold freely anyway. But Microsoft turned Word macros off by default years ago to improve security, so turning macros back on will leave you less secure. If. Whenever you receive spam, forward it to the FTC, at spam@uce.gov When you do that, try to include the email header information if you are able to do that. Just in case I just wanted to see what DodgyWare it might be and run the file through online virus scanner. Why do spam callers hang up when you answer? Bin/forget, Just had an email with my old name and address on with a zip file attached, did not open it as it seemed really odd, it had a pass number on it too, said it was a statement! Answer (1 of 3): Not in the least. The scam that knows your name and home address - here's what to do Sometimes I get the first name, someti. Follow @NakedSecurity on Twitter for the latest computer security news. On 3/24 I received an interesting email that was placed by Gmail in my spam folder. What you are saying "I didn't sign up for robo calls!" Every and any time you put your name, phone number and address into the internet for any reason or on a postcard or other "win a vacation" you are consenting. what if a hacker group has a front business that is solely used to purchase user data? I also replied to the email asking who the person was then I googled when I got home and found this. Nothing suspicious was detected. There was a previous wave of similar spam which included a valid telephone number. On the other hand, there must be some truth in the claims about a data leak, because the crooks know your name and address and not just vaguely, but precisely, so who knows what else they know about you? I wonder if thats significant? Id run something like Malwarebytes just for another check of your assets. * See the bogus file is corrupt message. So I think you are golden. A quick Google search of a phone number often tells me the person or company who's calling me. Quite how anyone thinks that is acceptable behaviour for a database that is supposed to regulate your elegibility to participate in secret ballots that are supposedly the cornerstone of modern democracy, Ill bite. I received one of these today zip file with password. The email contained my full name and home address with a zip file surname.zip telling me the contract was attached and gave me the password to open the file. With so many data breaches in the news recently, its perfectly reasonably to wonder, How serious is this?. You could also install and run SysInternals Process Explorer (edited to remove link) to see if you have any processes running that are identified by Virus Total as being malicious. I got one of these today claiming to be an order invoice, rather than threatening to dox me. So it feels wrong and risky to open it to see how much is in there. After all, if youre concerned about the trustworthiness of the sender, the worst thing you can do is to take their advice about computer security! News in brief: Alabama considers porn filters; Samsung launches new Galaxy; celebs Instagram hacked, Falling in love online? In fact, the GIF file has just 10 bytes of valid header data, followed by a 256-byte decryption key, followed by about 0.5MB of binary data scrambled by XORing it with the decryption key repeated over and over. The attack as it unfolded for us ended up with a Windows-specific program (the malware). (You only have one date of birth, one SSN, one national ID number, one mothers maiden name, one home address and all of those are somewhere from hard to impossible to change.). The malware ends up with a randomly-chosen numeric name, such as 05643.EXE. Providing access to your email address book is one common way for your name and other information to be obtained. Apple slips out zero-day update for older iPhones and iPads. I received one. Will ebay care? However, if you werent able to open the ZIP file in the first place, then you didnt even get to the beginning of the beginning of the attack, let alone to the beginning of the end. Sadly, however, its likely that the home addresses theyre using were stolen in one or more data breaches, and then sold on in the computer underground for criminal abuse of this sort. Why does the malicious file go to http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab and download this? The GIF header makes the file look innocent, even though it wont display as an image, and the Vigenre scrambling means that the suspicious parts of the file arent obvious. * Click [Enable Content]. Those calls will be brief, and often the call gets disconnected as soon as you say hello. It looked so legit that I tried to open on my iphone but it wouldnt work. That means it wouldnt work on an iPhone. The text in the emails vary slightly from sample to sample, but examples seen by SophosLabs go something like this: The salutation uses your first name (given name); the filename is your surname (family name); and the address is your home address, complete with postcode. I stupidly clicked on the zip file from my iphone but fortunately it didnt open as I cant even open legitimate zip files on my iphone. The data has definitely leaked out from somewhere, but as yet I dont know where.. OK, so I got suckered and did open the file have since run Avast and Sophos Virus Removal Tool, but came up with no hits have I got away with it? Good luck! Despite the zip file not opening do you think my iphone could still be at risk since I still opened the email and clicked on the zip file? It is the same scam, using an encrypted word document and macros. Yes, youre right Darren, but only for electors who dont opt out of the open register. Myself, my wife and daughter have all had one of these emails today, just the Word Doc and invoice. The information includes: name, address, DOB, political affiliation, last date voted, etc. If the macro gets an unexpected response on its first attempt to download the fake GIF, the crooks assume that some sort of firewall or web-filtering anti-virus blocked the download, so they try to talk you into turning your security filtering off: Its easy to assume that the popup comes from Word, or even Windows itself, but thats the crooks talking to you. I dont recall .dot files having vulnerabilities that .doc* files lack. Its understandable to feel a touch of fear when you receive a scam email that knows your name and home address, because of the lurking question, Why me?. Ive seen the fake package delivery notices, but this was a first with correct mailing address and full name included. Of course, the electoral register doesnt contain email addresses, phone numbers and the addresses would be up-to-date. Also, in one case the email was addressed to the recipients spouse and had the spouses work address. Answer (1 of 3): You most likely gave it to them when you signed up for spam calls. then never rely on replying or calling back to the original sender to ask if theyre honest. Hello, Its odd that the document (.dot) is actually a template a document thats used to create other documents. Make of that what you will its not impossible the it is a coincidental formatting error, but it might not be. Or was the sender just that incompetent they didnt know what they were sending? You know its a scam, not only from the terrible mistakes in spelling and grammar, but also from the fact that no official organisation would dare write what amounts to a veiled threat of this sort. I looked up on google and just stumbled upon this post, so Im (sorry guys) glad that it wasnt only me. Which can play back the ISPs in the US being able to harvest and sell all customer data the hackers can buy it, even if by proxy.. Once our data is out there, its there, As you sayonce out there, its out there , Thats why breaches can be so pernicious. When we tested out this attack in SophosLabs, the downloaded malware was Troj/Agent-AURH, a strain of bot or zombie malware that calls home to a so-called command-and-control (C&C) network for further instructions. Equally sneakily, the crooks pop up the following message, right at the very end: Its all a pack of lies: the file is corrupted message means exactly the opposite of what it says, because it only appears after the malware has been downloaded, unscrambled, saved to disk and launched in the background. If you do opt out, then your data is only available to certain organisations, like licensed credit reference agencies, who will (we understand) protect your data. This is a feature of Word you can write extensive and powerful Word extensions as macros, using Microsofts Visual Basic for Applications (VBA) programming language but because macros that arrive from outside can be super-dangerous, they dont run by default. Follow @NakedSecurity on Instagram for exclusive pics, gifs, vids and LOLs! Spammers have various methods to obtain information. In the case of this spam run and that one, all the email addresses, postal addresses and phone numbers seemed to be a few years old and not current. Oh the power of the Internet! Be prepared to explain yourself clearly, which typically means keeping suspicious emails and messages. You dont need to uninstall your existing anti-virus first our Virus Removal Tool is designed to work alongside other security products. How do spammers know my name? - Quora The document presents an official-looking help page that tells you that you need to Enable editing to view its content. Should I be worried if a spam caller uses my name in their message The same is true in the US, voter registration information is publicly available, and in some states the information is freely available through commercial sites. I assume that Im OK and that the malware hasnt been placed on the phone? The crooks have come up with many ways to trick you into clicking [Enable content], usually by making it sound as though it somehow increases security, for example by decrypting or unlocking confidential information. It claimed to be a notice for a failed package delivery. When we tested out this attack in SophosLabs, the downloaded malware was Troj/Agent-AURH, a strain of bot or zombie . Our zombified computer didnt receive any instructions during our test, but its important to remember that in attacks of this sort: The malicious macro in the original document has two more tricks up its sleeve to go along with the fake GIF file unscrambling shenanigans. Sophos Home protects every Mac and PC in your home. If you click on [Enable Content], youre agreeing to execute a malicious VBA program that tries two different web pages, hosted on hacked web servers, and downloads what looks like a GIF file. Thanks, Got exactly the same just now, iPhone isnt at risk IMO. 192.com holds the same info for a subscription fee and credits. Indeed, the scamminess of the text made the email more worrisome, and thus perhaps paradoxically more likely to squeeze victims into action than a well-written email from an obviously unlikely source. All UK name and address information is available via the electroral register which there are commercial vrsions to purchase UK info disk used to be a good one. The @bit was wanadoo.fr. It would appear its not just those in the UK targeted, but also the US. Have you recently opened an email that you now have reason to distrust, or are you concerned that you may have let malware sneak in by taking risky advice that came from someone you dont know? How do spam callers know your name? - Quora !, thanks for flagging this up guysI received an email today (edited to remove link) very similar to ones described above starting with good day to you then my home address (which was the worrying part) and a word doc attachmentI am pretty much aware of the scams etc but I nearly feel for thisuntil I noticed they Got my name slightly wrong..(using one I once registered when I opened a google account using a variation of my name). The malware ends up with a randomly-chosen numeric name, such as 05643.EXE. GIF is short for Graphics Interchange Format, an old but still-common type of image file. Thanks to Graham Chantry and Tad Heppner of SophosLabs for their help with this article. The good news, if you can call it that, is that through articles and advisories like this one, youll soon see that you arent alone, and that the crooks are targeting a much wider group than just you. I received an email this morning from an individual first name and surname @sfr.fr I have about 12 active email addresses that I use for various things and websites, the email address that this arrived in is one that to the best of my knowledge is only used by Ebay and Paypal. What happens when you answer a spam call? Collectively, were getting better and better at spotting emails that dont come from where they say, for example because our real bank doesnt call us Dear Customer, and because our real mortgage provider knows how to spell its own kompani nayme without making absurd misteaks.