Comments

Fake HMRC “Accelerated payment notice ” delivers Trickbot via Microsoft Equation Editor and file link updater exploits — 5 Comments

  1. from customer.worldstream.nl (HELO hmrc-notice.co.uk) ([109.236.87.235])
    from free.hostsailor.com (HELO hmrc-email.co.uk) ([185.106.121.211])
    from tt.tt.tt (HELO hmrc-email.co.uk) ([78.41.207.206])
    from unknown (HELO hmrc-notice.co.uk) ([95.211.168.38])

  2. I received one of these emails and noticed that the “to” email address is one that I use only for the Sunday Times Wine Club. I have received other phishing emails, purporting to come from banks (Lloyds, NatWest), at this email address also, so I assume there has been a leak at Sunday Times Wine Club. Perhaps I should report them to the Data Protection Regulator?

  3. I received one of these, I do in fact owe HMRC some money and the amount shown in the fake notice matched exactly what I owe. However it was a fake notice (it had the same return email and ref: number as the fake) and I wonder if somebody with access to the HMRC databases is responsible.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.