MESSAGE TEXT
From:
Date: Wed, Feb 8, 2017 at 9:20 AM
Subject: fraudulent card charge
To: name @ umn.edu
Who the XXXX are you and why is there a charge from umn.edu on my card?
Here you can view my statement , get back to me asap.
bofa_card_statement_name.doc
<hxxp:// www. xxxx .co.jp/api/get.php?id=xxx >
Thank you
Tyler Holmes
NOTES
- multiple recipients
- email to "name@umn.edu" has a link to bofa_card_statement_name.doc that really attempts to download an infected Word document
- payload now blocked on UMN network
- IMPORTANT: anyone who downloaded and opened the document should contact their tech support to check their computer.
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.