Outline
Email purporting to be from Costco thanks you for your recent order and invites you to view order details by clicking a link.
Brief Analysis
The email is not from Costco. Clicking the link opens a website that contains malware. Once installed, this malware may collect personal information from your computer and connect with servers operated by criminals. If you receive this email, do not click any links or open any attachments that it contains.
Example
Subject: Thank you for buying from Costco
Costco
WHOLESALE
Our online store Costco.com received an order and the personal data of the recipient coincide with yours.
You may get your order in the nearest Local Store.
Attention! Your order can be reserved within 4 days.
You may see order details here .
Happy Thanksgiving Day!
Truly yours,
Costco.com
Detailed Analysis
According to this ‘thank-you’ email, which purports to be from Costco, the company has received your order and you may pick it up at a local store.
The email invites you to click a link to view details about the supposed order. The message includes the Costco name logo and is designed to emulate a genuine email from the company.
However, the email is not from Costco and the link does not open information about an order. Instead, the link opens a website that harbours malware. Clicking the link automatically downloads a .zip file. In the sample I tested, the file was named CostcoOrderInfo-Tennyson.zip. File names may vary in different incarnations of the scam.
Opening the .zip file reveals a .exe file with a similar name. Clicking this .exe file will install the malware on your computer.
Typically, such malware can harvest sensitive information from the infected computer and send it to online criminals. It may also download and install further malware components and allow the criminals to control the computer from afar.
Criminals often send out bogus order notifications as a means of tricking people into installing malware. The messages have used the names of many high profile companies.
Some versions include the malware in an attached file rather than on a compromised website.
If you receive one of these emails, do not click any links or open any attachments that it contains.
If you have an account with the store named in the email, it is safer to log in by entering the address in your browser’s address bar rather than by clicking a link.
Original Source : https://www.hoax-slayer.net/fake-costco-order-notification-leads-to-malware/