{"id":12553,"date":"2022-03-25T05:04:14","date_gmt":"2022-03-25T05:04:14","guid":{"rendered":"https:\/\/myonlinesecurity.co.uk\/?p=12553"},"modified":"2022-03-25T05:04:14","modified_gmt":"2022-03-25T05:04:14","slug":"contract-61936417-about-to-expire-final-notice-western-union-business-solutions-online-fx-for-corporate-fake-pdf-malware","status":"publish","type":"page","link":"https:\/\/myonlinesecurity.co.uk\/contract-61936417-about-to-expire-final-notice-western-union-business-solutions-online-fx-for-corporate-fake-pdf-malware\/","title":{"rendered":"Contract 61936417 About To Expire: Final Notice \u2013 Western Union Business Solutions Online FX For Corporate \u2013 Fake PDF Malware"},"content":{"rendered":"
An email with the subject of Contract 61936417 About to Expire: Final Notice \u2013 Western Union Business Solutions Online FX for Corporate pretending to come from Western Union via random email addresses and companies with a zip attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They use email addresses and subjects that will entice a user to read the email and open the attachment.<\/p>\n
A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers.<\/p>\n
The content of the email says :<\/p>\n
Please check attached file for your contract 45827544. Contract 45827544 will expire on 9\/30\/2021.<\/em><\/p>\n Contract Id FX Currency FX Amount Rate Settl. Amount Settl. Currency Open Date Close Date Direction<\/em> Western Union Business Solutions is proud to present our online foreign exchange services powered by Custom House\u200e. \u200eWestern Union acquired Custom House\u200e, \u200ea foreign \u200eexchange and international payments company\u200e, \u200ein \u200e2009 \u200eand owns and operates Custom House along with its products and services under the Western Union name\u200e.<\/em><\/p>\n The information transmitted, including any content in this communication is confidential, is intended only for the use of the intended recipient and is the property of The Western Union Company or its affiliates and subsidiaries. If you are not the intended recipient, you are hereby notified that any use of the information contained in or transmitted with the communication or dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the Western Union sender immediately by replying to this message and delete the original message<\/em><\/p>\n These malicious attachments normally have a password stealing component, with the aim of stealing your bank, PayPal or other financial details along with your email or FTP ( web space) log in credentials. Many of them are also designed to specifically steal your Facebook and other social network log in details.<\/p>\n None of the companies that seem to be sending these emails have been hacked or had their email or other servers compromised. They are not sending the emails to you. They are just innocent victims in exactly the same way as every recipient of these emails.<\/p>\n All the alleged senders, amounts, reference numbers, Bank codes, companies, names of employees, employee positions, email addresses and phone numbers mentioned in the emails are all random. Some of these companies will exist and some won\u2019t.<\/p>\n Don\u2019t try to respond by phone or email, all you will do is end up with an innocent person or company who have had their details spoofed and picked at random from a long list that the bad guys have previously found. The bad guys choose companies, Government departments and organisations with subjects that are designed to entice you or alarm you into blindly opening the attachment or clicking the link in the email to see what is happening.<\/p>\n Please read our How to protect yourselves page<\/a> for simple, sensible advice on how to avoid being infected by this sort of socially engineered malware.<\/p>\n 29 September 2021: WU Business Contract 45827544.zip: Extracts to: WU Business Contract 770352457.scr Current Virus total detections<\/a>:<\/p>\n This is another one of the spoofed icon files that unless you have \u201cshow known file extensions enabled<\/a>\u201c, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected.<\/p>\n
\n45827544 USD 2605.42 0.7603 3129.28 AUD 9\/26\/2021 9\/30\/2021 Buy<\/em>
\nThank you for using Western Union Business Solutions. Sincerely, Western Union Business Solutions Please do not reply directly to this system-generated e-mail. This address cannot accept incoming messages. If you have any questions please do not hesitate to call your Western Union Business Solutions Account Representative.<\/em><\/p>\n