May 19, 2017

The other day my dad got a really authentic looking Canada Post email that said he had an unclaimed package waiting for him at the post office. He did just make a rather expensive purchase that he was waiting on in the mail so he didn't think twice about clicking the tracking number on screen before going up to get the package. As soon as he did he got hit with a .zip file. I quarantined and deleted the file and ran a bunch of different anti virus software and it all came back clean, but he was getting blasted with spam emails that the spam filter wasn't picking up. I was confused as f--- about this and what the point would be in blasting him with spam, I'm talking literally at least 1 email a second. He got almost 50k emails in the past 3 days from random sites and obvious spam s---. I thought they just had some kind of tracking info in the fake Canada Post email which would let them see that he clicked the link and would be vulnerable to other scams, but it turns out that the zip file had some malware on it that instantly infected his computer and hid itself from the anti viruses I installed. He was being blasted with emails because last night he was charged over 10 thousand dollars through paypal, and I suspect they were hitting him so hard so fast so that he would miss the paypal emails coming through.

Before I knew that this was a phishing scam and I thought it was just a bunch of spam coming through, I told him to scroll through and shift-click the top email and the bottom one and mass report as spam so hopefully the spam filters would catch on and it'd start automatically filtering some of them. When he was doing that and scrolling through to the top he noticed that there was about 15 emails that were all the same subject and sender, They all said "You've successfully sent a payment!" and were all from paypal. I thought they were fake at first and they were another attempt to get you to click a link with a spoofed email address and format like the Canada Post one he got, but we logged into his paypal through his phone and found out that there were about 5 $700+ charges made to his credit card that were made to some phony "rental company". Just before that there were about 10 $500+ charges that had the reason listed as "goods and services".

We were lucky to catch it when we did, because if we missed the emails in the blast of spam we got and somehow the charges went undetected there'd be no recourse. We had the paypal account put on lockdown, we terminated the e-mail (it was one of those emails you get through your ISP when you join them) and called the credit card company and all charges are going to be investigated and ultimately dropped, and I also ran some more intensive malware-specific anti viruses and got rid of the hidden files. I was f---ing baffled at how fast this all happened. I thought e-mail scams were targeting old folks homes with poor grammar and english, and they required you to enter credit card information to actually get money from you.

Just wanted to throw that PSA out there. My dad's in his mid 50s, he's far from some old geezer who's falling for Nigerian prince scams, he was just expecting a rather expensive package in the mail and thought he got an alert from the post office that it arrived. s---'s getting real out here. If you or your fam get hit with this email bombardment thing, go ahead and lock up your paypal account and any personal information you have related to that email. And don't trust false negatives on anti virus programs. Idk if the states have a Canada Post equivalent (USPS I guess?) but keep an eye out brehs s--- looked authentic at a first glance and tbh I probably wouldn't have thought much of it either if I were expecting something that I ordered with that email address

 

May 19, 2017

If I think a computer has something that the antivirus didn't pick up, I immediately scan it with malwarebytes (free), then Hitman Pro (Free), and a quick cleanup with Adware (free), and find those always take care of the issue. Anti-Viruses aren't great at picking up malware.

One of my clients did something similar and clicked on a link in an email that downloaded ransomware. That s--- is bad, encrypted all of her files and holds it for ransom and won't give you a key to unlock the files unless you pay the ransom. She wound up having to format the hard drive and losing all her files that weren't in the cloud

 

May 19, 2017

TLDR: Email scams aren't simple "im frim nigeria pay me $40 grand and i wil transfer u 1million dolars pls" anymore and the s----s getting more and more authentic looking so keep u wits about u

 

May 19, 2017

Glad you caught it when you did. Still blows though

 

May 19, 2017

Here's the link to the site I was talking about:
https://forums.malwarebytes.com/forum/7-malware-removal-for-windows/

Lots of virus type stuff can hide itself so that wipes won't even clear it short of uninstalling and reinstalling the operating system.

 

May 19, 2017

Yeah the second paragraph sounds like that virus i mentioned before, it's meant to be immune to anti-virus software in some way, i assume it's via some exploit in outdated windows as apparently that's how you get it and they only way to prevent it is to keep windows up to date.