Just had an email telling me I have an outstanding invoice of £1000+ for a company that from Google looks to be an engineering firm. The invoice has come from a collection agency by the looks of it but the website dosent exist..the invoice is a .zip which makes me think it is spam however it says that an original invoice will be sent to my address which is written on the email...I've ignored it but I'm a little worried as it has my address on it...not my usual kinda spam.

You should be able to check the name of the recovery firm via companies house.

 

However if it looks like spam, smells like spam, sounds like spam.......

.....the invoice is a .zip....

 

Don't touch :peek:.  Wait for something in ink on paper through your letterbox. 

It's OK had another one from a different address with the same amount but a different company. Defo spam but it's scary it has my address.

Your spam sense has now achieved level - suspicious

 

I'm up to level  - tinfoil

 

If you opened the zip, you should now run a full AM/AV sweep using an online AV program, Malwarebytes and Spybot S&D.

It's usually something (a macro) embedded within an office document with these so if you didn't open that you're probably fine.

 

Buuuuut ^ is never bad advice after anything dodgy crosses your path.

 

I'll quite often run a Malwarebyutes scan after anything tweaks my paranoia, did it last night after the browser crashed then the disk access seemed a bit excessive.

Nothing flagged up and it was probably a MS stealth 'update'.

Edited 4 April, 201610 yr by Aspman

Didn't open the file. Saw it was a .zip so was pretty sure it was spammage!

It had your physical address?

Could be a scam due to a previous infection data mining your machine, or your email and physical address exist together somewhere online - especially if you have any domain names registered

Yep, physical address. I do have some domains registered...could be that.

Or a Talktalk leak

Yep, physical address. I do have some domains registered...could be that.

 

I think I've seen that one at work. I'm sure the payload is some Dridex (banking trojan) variant.

 

Not quite sure how they are doing the data matchup, easier with businesses than individuals.

[clicky click]

 

There are a few new malware variants doign this at the moment.

If the email had a link to the the .Zip rather than an attachment then it's likely that the payload is a new cryptolocker called Maktub.

apparenly the address information is a couple of years out of date so not sure of the source.

 

Spam with malicious 'Invoices' are very popular right now becasue they are effective particularly against businesses. Few big companies are complaining right now about being impersonated. Bad for their reputation and they get hit with the reflected bounceback of email error messages.

 

[edit]

 

There is also a Teslacrypt/Lock campaign running with invoice spam - "Invoice_ref-12345678.zip". Dosn't use addresses though.

Edited 5 April, 201610 yr by Aspman

http://www.bbc.co.uk/news/technology-35977227

. Few big companies are complaining right now about being impersonated. Bad for their reputation and they get hit with the reflected bounceback of email error messages.

 

[edit]

 

Swimbo is getting a regular 4/5 e mails from "name that store" telling her that she's got a gift voucher etc to collect.