When you work for a corporation, seeing email form IT is routine. Sometimes, those emails are urgent, and rightfully so, but this sense of urgency is what criminals look to exploit.
On Wednesday afternoon, one such email, with an overly urgent subject line, arrived in my inbox. I wasn’t the only one; others at CSO got them too. In fact, I’m betting a good deal of people at IDG Enterprise got this email.
The subject line, “Warning!!! Account owner” portrays a level of urgency that demands the message be opened. Inside, the potential victim will see the following:
Information Technology Services (ITS) are currently upgrading e-mail accounts. This will provide you the ability to store a greatly increased amount of e-mail correspondence in your e-mail account.
Your account has been identified as one of the accounts which are to be upgraded. Please click the link below and follow the instruction
Click here REDACTED
The new minimum quota level for e-mail accounts will be set to 1000MB.
Regards,
IT Help Desk Team
The email iself is a form generated email. It’s a cookie-cutter scam that has been used since 2010, and often delivered by compromised webservers, email accounts (as the message and simply be cut and pasted) and bots. The original script itself has origins on IRC, but today it’s mostly found in modular Phishing kits that are sold and traded online.
In fact, the basic wording of the email can be altered for any number of scams. In my case, it’s asking for email account data, but it’s also been used to scam PayPal accounts. The email I’m examining today has been flagged by the University of Virginia, the University of Alaska, the University of Hawaii, the University of Michigan, just to name a few.
When the email arrived, the overly urgent subject line immediately told me something was off. While the IT team that supports me and my co-workers will send status emails and urgent notifications, this isn’t their style or tone.
But, it’s my nature to be curious, so I opened the message in plain text.
The body of the message, as previously shown, stands out in plain text. The URL where I am supposed to “verify” my account isn’t a corporate domain. Not even close. So that was all the proof I needed to know this message was a fake. For the curious, following the link takes you to the form seen below.
The script running the scam does two things once the form is submitted, it logs all of the information entered to a simple text file on the server, and forwards the visitor to a thank you page. Nothing complex, nothing overly technical, just a simple form that logs data and redirects a user.
Knowing the email was fake wasn’t enough for me however, I wanted to know where it came from and how it got past the spam filters used by my company. As it turned out, the email’s headers gave me all the information I needed.
One of the header lines told me the message originated from Google’s servers, and passed through our spam filters with a high legitimacy score. After all, it’s Google, so trust is implied by default in the anti-Spam software. Sad, but true.
Continue Reading