Outline:
Email purporting to be from Australian energy provider AGL supposedly contains details of your monthly bill and claims that you can click to view bill details or get more information.
Brief Analysis:
The email is not from AGL. It is a criminal ruse designed to trick you into visiting a compromised website and downloading Torrentlocker ransomware. Once installed, Torrentlocker can encrypt your computer files and then demand that you pay a ransom to receive an encryption key.
Detailed Analysis:
Australian inboxes are currently being hit by a spate of emails that look like they come from Australian energy giant AGL. The emails appear to be a bill for your electricity account and include buttons that you can click to view your bill or get more information. The emails are professionally presented and feature the AGL logo.
However, the emails are certainly not from AGL and clicking the buttons will not open information about an electricity bill. The emails are designed to trick you into installing dangerous malware on your computer.
Clicking the links opens a webpage that appears to be part of the genuine AGL website. The page asks you to enter a Captcha code to access your bill. After you enter the code, a .zip file supposedly containing your bill will be downloaded to your computer. The .zip file harbours a malicious JavaScript file that, if opened, can download and install a version of the infamous Torrentlocker ransomware. Once installed, Torrentlocker can lock up all of your important computer files and then demand that you pay a ransom to online criminals to recover them.
Details, such as the bogus account number and bill amount, may vary in different versions of these emails. AGL has published a warning about this malware attack on its website, noting:
Customers and non-customers have received scam emails that pretend to be from AGL, which claim you owe money for an outstanding gas or electricity bill and ask you to click on a link to view your account or to make a payment.
Remember, AGL will never send you emails asking for personal banking or financial details.
Anyone receiving a suspicious email should delete it immediately or, if opened, not click on any links within the email. AGL advises recipients of any suspicious emails to run antivirus software and block the sender by adding to the junk folder list.
The names of other high-profile Australian entities, including Australia Post and the AFP, have been used in similar malware attacks in recent months. And, similar fake AGL bill emails have been used to distribute other types of malware.
Last updated: June 2, 2016
First published: June 2, 2016
By Brett M. Christensen
About Hoax-Slayer
References
Fake AGL Bill Email Contains Malware
Announcement: Spam email “Your electricity bill”
AGL Scam Carrying Crypto Ransomware Torrentlocker Hits Australian Inboxes
AFP 'You've Received A Subpoena' Malware Email
Australia Post 'Your Package Has Experienced An Exception' Malware Email
Original Source : https://www.hoax-slayer.net/bogus-agl-electricity-bill-email-points-to-torrentlocker-ransomware/