{"id":1057,"date":"2019-04-06T19:33:30","date_gmt":"2019-04-06T19:33:30","guid":{"rendered":"http:\/\/www.syyhoaxanalyzer.com\/?p=1057"},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-29T17:00:00","slug":"Bogus-AGL-Electricity-Bill-Email-Points-To-Torrentlocker-Ransomware","status":"publish","type":"post","link":"http:\/\/www.syyhoaxanalyzer.com\/?p=1057","title":{"rendered":"Bogus AGL Electricity Bill Email Points To Torrentlocker Ransomware"},"content":{"rendered":"<div>\n<p><span style=\"color: #ff0000;\"><strong>Outline:<\/strong><\/span><br \/>\nEmail purporting to be from Australian energy provider AGL supposedly contains details of your monthly bill and claims that you can click to view bill details or get more information.<\/p>\n<p><span style=\"color: #ff0000;\"><strong>Brief Analysis:<\/strong><\/span><br \/>\nThe email is not from AGL. It is a criminal ruse designed to trick you into visiting a compromised website and downloading \u00a0Torrentlocker ransomware. Once installed, Torrentlocker can encrypt your computer files and then demand that you pay a ransom to receive an encryption key.<br \/>\n<!-- HS Net Top Content Responsive --><br \/>\n<ins class=\"adsbygoogle\" style=\"display: block;\" data-ad-client=\"ca-pub-0355887770822260\" data-ad-slot=\"4870821038\" data-ad-format=\"auto\"><\/ins><br \/>\n<script>\/\/ <![CDATA[\n(adsbygoogle = window.adsbygoogle || []).push({});\n\/\/ ]]&gt;<\/script><\/p>\n\n\n\n\n<div class=\"example\"><span style=\"color: #ff0000;\"><b>Example:<\/b><\/span><br \/>\n<a href=\"http:\/\/hoax-slayer.net\/wp-content\/uploads\/2016\/06\/agl-fake-bill-ransonware-email-1.jpg\" data-rel=\"penci-gallery-image-content\" ><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"1908\" data-permalink=\"https:\/\/www.hoax-slayer.net\/bogus-agl-electricity-bill-email-points-to-torrentlocker-ransomware\/agl-fake-bill-ransonware-email-1\/\" data-orig-file=\"https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2016\/06\/agl-fake-bill-ransonware-email-1.jpg\" data-orig-size=\"800,690\" data-comments-opened=\"0\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"agl-fake-bill-ransonware-email-1\" data-image-description=\"\" data-medium-file=\"https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2016\/06\/agl-fake-bill-ransonware-email-1-300x259.jpg\" data-large-file=\"https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2016\/06\/agl-fake-bill-ransonware-email-1.jpg\" class=\"aligncenter size-full wp-image-1908\" src=\"https:\/\/hoax-slayer.net\/wp-content\/uploads\/2016\/06\/agl-fake-bill-ransonware-email-1.jpg\" alt=\"AGL Fake Bill Ransomware Email\" width=\"800\" height=\"690\" srcset=\"https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2016\/06\/agl-fake-bill-ransonware-email-1.jpg 800w, https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2016\/06\/agl-fake-bill-ransonware-email-1-300x259.jpg 300w, https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2016\/06\/agl-fake-bill-ransonware-email-1-768x662.jpg 768w, https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2016\/06\/agl-fake-bill-ransonware-email-1-232x200.jpg 232w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/a><\/div>\n\n\n\n\n<p><!-- HSNet Article Center --><br \/>\n<ins class=\"adsbygoogle\" style=\"display: block;\" data-ad-client=\"ca-pub-0355887770822260\" data-ad-slot=\"5727909035\" data-ad-format=\"auto\"><\/ins><br \/>\n<script>\/\/ <![CDATA[\n(adsbygoogle = window.adsbygoogle || []).push({});\n\/\/ ]]&gt;<\/script><\/p>\n\n\n\n\n<p><span style=\"color: #ff0000;\"><strong>Detailed Analysis:<\/strong><\/span><br \/>\nAustralian inboxes are currently being hit by a spate of emails that look like they come from Australian energy giant AGL. The emails appear to be a bill for your electricity account and include buttons that you can click to view your bill or get more information. The emails are \u00a0professionally presented and feature the AGL logo.<\/p>\n\n\n\n\n<p>However, the emails are certainly not from AGL and clicking the buttons will not open information about an electricity bill. The emails are designed to trick you into <a title=\"AGL Scam Carrying Crypto Ransomware Torrentlocker Hits Australian Inboxes\" href=\"http:\/\/www.mailguard.com.au\/blog\/agl-scam-carrying-crypto-ransomware-torrentlocker-hits-australian-inboxes\">installing dangerous malware<\/a> on your computer.<\/p>\n\n\n\n\n<p>Clicking the links opens a webpage that appears to be part of the genuine AGL website. The page asks you to enter a \u00a0Captcha code to access your bill. After \u00a0you enter the code, a .zip file supposedly containing your bill will be downloaded to your computer. The .zip file harbours a malicious JavaScript file that, if opened, can download and install a version of the infamous Torrentlocker ransomware. Once installed, Torrentlocker can lock up all of your important computer files and then demand that you pay a ransom to online criminals to recover them.<\/p>\n\n\n\n\n<p>Details, such as the bogus account number and bill amount, may vary in different versions of these emails. AGL has published a warning about this malware attack on its website, <a title=\"Announcement: Spam email \" href=\"https:\/\/community.agl.com.au\/t5\/Welcome-and-Guidelines\/Announcement-Spam-email-quot-Your-electricity-bill-quot\/m-p\/782#M25\">noting<\/a>:<\/p>\n\n\n\n\n<blockquote>\n\n<p><em>Customers and non-customers have received scam emails that pretend to be from AGL, which claim you owe money for an outstanding gas or electricity bill and ask you to click on a link to view your account or to make a payment.<\/em><\/p>\n\n\n\n\n<p><em>Remember, AGL will never send you emails asking for personal banking or financial details.<\/em><\/p>\n\n\n\n\n<p><em>Anyone receiving a suspicious email should delete it immediately or, if opened, not click on any links within the email.  \u00a0AGL advises recipients of any suspicious emails to run antivirus software and block the sender by adding to the junk folder list.<\/em><\/p>\n\n<\/blockquote>\n\n\n\n\n<p>The names of other high-profile Australian entities, including <a title=\"Australia Post 'Your Package Has Experienced An Exception' Malware Email\" href=\"http:\/\/hoax-slayer.net\/australia-post-your-package-has-experienced-an-exception-malware-email\/\">Australia Post<\/a> and the <a title=\"AFP 'You've Received A Subpoena' Malware Email\" href=\"http:\/\/hoax-slayer.net\/afp-youve-received-a-subpoena-malware-email\/\">AFP<\/a>, have been used in similar malware attacks in recent months. And, similar <a title=\"Fake AGL Bill Email Contains Malware\" href=\"http:\/\/hoax-slayer.net\/fake-agl-bill-email-contains-malware\/\">fake AGL bill emails<\/a> have been used to distribute other types of malware.<\/p>\n\n\n\n\n<div align=\"center\"><script src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\" async=\"\"><\/script><br \/>\n <!-- HS Net Bottom AdLinks --><br \/>\n <ins class=\"adsbygoogle\" style=\"display: block;\" data-ad-client=\"ca-pub-0355887770822260\" data-ad-slot=\"1358951439\" data-ad-format=\"link\"><\/ins><br \/>\n<script>\/\/ <![CDATA[\n(adsbygoogle = window.adsbygoogle || []).push({});\n\/\/ ]]&gt;<\/script><\/div>\n\n\n\n\n<p class=\"date\">Last updated: June 2, 2016<br \/>\nFirst published: June 2, 2016<br \/>\nBy Brett M. Christensen<br \/>\n<a class=\"foot\" href=\"http:\/\/www.hoax-slayer.com\/about.shtml\">About Hoax-Slayer<\/a><\/p>\n\n\n\n\n<p class=\"ref\">References<br \/>\n<a title=\"Fake AGL Bill Email Contains Malware\" href=\"http:\/\/hoax-slayer.net\/fake-agl-bill-email-contains-malware\/\">Fake AGL Bill Email Contains Malware<\/a><br \/>\n<a title=\"Announcement: Spam email \" href=\"https:\/\/community.agl.com.au\/t5\/Welcome-and-Guidelines\/Announcement-Spam-email-quot-Your-electricity-bill-quot\/m-p\/782#M25\">Announcement: Spam email &#8220;Your electricity bill&#8221;<\/a><br \/>\n<a title=\"AGL Scam Carrying Crypto Ransomware Torrentlocker Hits Australian Inboxes\" href=\"http:\/\/www.mailguard.com.au\/blog\/agl-scam-carrying-crypto-ransomware-torrentlocker-hits-australian-inboxes\">AGL Scam Carrying Crypto Ransomware Torrentlocker Hits Australian Inboxes<\/a><br \/>\n<a title=\"AFP 'You've Received A Subpoena' Malware Email\" href=\"http:\/\/hoax-slayer.net\/afp-youve-received-a-subpoena-malware-email\/\">AFP 'You've Received A Subpoena' Malware Email<\/a><br \/>\n<a title=\"Australia Post 'Your Package Has Experienced An Exception' Malware Email\" href=\"http:\/\/hoax-slayer.net\/australia-post-your-package-has-experienced-an-exception-malware-email\/\">Australia Post 'Your Package Has Experienced An Exception' Malware Email<\/a><\/p>\n\n\n\n\n<p>&nbsp;<\/p>\n\n\n<\/br><\/br> Original Source : <a href=\"https:\/\/www.hoax-slayer.net\/bogus-agl-electricity-bill-email-points-to-torrentlocker-ransomware\/\" target=\"_blank\">https:\/\/www.hoax-slayer.net\/bogus-agl-electricity-bill-email-points-to-torrentlocker-ransomware\/<\/a><br \/>\n<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Outline: Email purporting to be from Australian energy provider AGL supposedly contains details of your monthly bill and claims that you can click to view bill details or get more information. Brief Analysis: The email is not from AGL. It is a criminal ruse designed to trick you into visiting a compromised website and downloading [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":6890,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1057","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hoax-inggris"],"_links":{"self":[{"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/posts\/1057"}],"collection":[{"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1057"}],"version-history":[{"count":0,"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/posts\/1057\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/media\/6890"}],"wp:attachment":[{"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1057"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1057"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1057"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}