{"id":959,"date":"2019-04-06T19:33:29","date_gmt":"2019-04-06T19:33:29","guid":{"rendered":"http:\/\/www.syyhoaxanalyzer.com\/?p=959"},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-29T17:00:00","slug":"ATO-\"Right-to-Obtain-a-Refund\";-Malware-Emails","status":"publish","type":"post","link":"http:\/\/www.syyhoaxanalyzer.com\/?p=959","title":{"rendered":"ATO &#8220;Right to Obtain a Refund&#8221;; Malware Emails"},"content":{"rendered":"<div>\n<p><span style=\"color: #ff0000;\"><strong>Outline:<\/strong><\/span><br \/>\nEmails purporting to be from the Australian Taxation Office (ATO) claim that you have \u00a0the right to obtain a refund or reimbursement and should therefore click a link to download more information.<br \/>\n<script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script><br \/>\n<!-- HS Net Top Content Responsive --><br \/>\n<ins class=\"adsbygoogle\" style=\"display: block;\" data-ad-client=\"ca-pub-0355887770822260\" data-ad-slot=\"4870821038\" data-ad-format=\"auto\"><\/ins><br \/>\n<script>\n(adsbygoogle = window.adsbygoogle || []).push({});\n<\/script><br \/>\n<span style=\"color: #ff0000;\"><strong>Brief \u00a0Analysis:<\/strong><\/span><br \/>\nThe emails are not from the ATO and the promised refund does not exist. It is a criminal ruse designed to trick you into visiting a fraudulent website and downloading malware.<\/span><\/p>\n<div class=\"example\"><span style=\"color: #ff0000;\"><b>Example:<\/b><\/span><br \/>\nIMPORTANT NOTICE Australian Taxation Office &#8211; 20\/10\/2016<\/p>\n<p>After the last estimation of your fiscal actions has been found that you have the right to obtain a refund of 2335.85 AUD.Please follow the link below to download the deal information: [link removed]<\/p>\n<p>Liam Wesley,<br \/>\nTax Refund Department<br \/>\nAustralian Taxation Office<\/p>\n<\/div>\n<div class=\"example\"><span style=\"color: #ff0000;\"><b>Example:<\/b><\/span><br \/>\nSIGNIFICANT NOTIFICATION Australian Taxation Office &#8211; 20\/10\/2016<\/p>\n<p>After the last estimation of your financial activity has been found that you have the right to obtain a reimbursement of 7272.48 AUD.Please follow the link below to download the operation information: [link removed]<\/p>\n<p>James Wesley,<br \/>\nTax Refund Department<br \/>\nAustralian Taxation Office<\/p>\n<\/div>\n<p><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script><br \/>\n<!-- HSNet Article Center --><br \/>\n<ins class=\"adsbygoogle\" style=\"display: block;\" data-ad-client=\"ca-pub-0355887770822260\" data-ad-slot=\"5727909035\" data-ad-format=\"auto\"><\/ins><br \/>\n<script>\n(adsbygoogle = window.adsbygoogle || []).push({});\n<\/script><br \/>\n<span style=\"color: #ff0000;\"><strong>Detailed Analysis:<\/strong><\/span><br \/>\nAccording to a series of emails that claim to be from the Australian Taxation Office (ATO), you have the right to obtain a refund or reimbursement for several thousand dollars. The emails include a link  \u00a0that supposedly downloads \u00a0a document with more information about your unexpected refund.<\/p>\n<p>Clicking the link opens a fake ATO &#8220;download center&#8221; webpage (see screenshot below) that prompts you to download what it claims is a PDF containing a declaration form.<\/p>\n<p>However, the supposed PDF is in fact a .zip file that harbours a malicious .scr file. If you click the .scr file, it can install malware on your computer.<\/p>\n<p>Details, such as the amount of the supposed refund and the name of the supposed ATO staff member listed in the signature may vary in different versions of the emails. Some versions claim to be from the &#8220;Australian Taxation Bureau&#8221; rather than the ATO.<\/p>\n<p>The &#8220;tax refund&#8221; ruse has been used repeatedly in both <a title=\"ATO 'Tax Refund Notification' Phishing Scam Email\" href=\"http:\/\/hoax-slayer.net\/ato-tax-refund-notification-phishing-scam-email\/\">phishing<\/a> and <a title=\"ATO Tax Refund Malware Emails\" href=\"http:\/\/www.hoax-slayer.com\/ato-tax-refund-malware-emails.shtml\">malware<\/a> attacks. The ATO will never send you an unsolicited email that claims that you must click a link or opened an attached file to process a refund.<\/p>\n<p>If you receive one of these emails, do not click any links or open any attachments that it contains.<\/p>\n<p><strong>A screenshot of the bogus website:<\/strong><\/p>\n<p><a href=\"http:\/\/hoax-slayer.net\/wp-content\/uploads\/2016\/10\/ato-downlaod-center-malware-1.jpg\" data-rel=\"penci-gallery-image-content\" ><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"2824\" data-permalink=\"https:\/\/www.hoax-slayer.net\/ato-right-to-obtain-a-refund-malware-emails\/ato-downlaod-center-malware-1\/\" data-orig-file=\"https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2016\/10\/ato-downlaod-center-malware-1.jpg\" data-orig-size=\"800,371\" data-comments-opened=\"0\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"ato-downlaod-center-malware-1\" data-image-description=\"\" data-medium-file=\"https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2016\/10\/ato-downlaod-center-malware-1-300x139.jpg\" data-large-file=\"https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2016\/10\/ato-downlaod-center-malware-1.jpg\" class=\"aligncenter size-full wp-image-2824\" src=\"https:\/\/hoax-slayer.net\/wp-content\/uploads\/2016\/10\/ato-downlaod-center-malware-1.jpg\" alt=\"Fake ATO website harbours malware\" width=\"800\" height=\"371\" srcset=\"https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2016\/10\/ato-downlaod-center-malware-1.jpg 800w, https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2016\/10\/ato-downlaod-center-malware-1-300x139.jpg 300w, https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2016\/10\/ato-downlaod-center-malware-1-768x356.jpg 768w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/a><\/p>\n<div align=\"center\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script><br \/>\n<!-- HS Net Bottom AdLinks --><br \/>\n<ins class=\"adsbygoogle\" style=\"display: block;\" data-ad-client=\"ca-pub-0355887770822260\" data-ad-slot=\"1358951439\" data-ad-format=\"link\"><\/ins><br \/>\n<script>\n(adsbygoogle = window.adsbygoogle || []).push({});\n<\/script><\/div>\n<p class=\"date\">Last updated: October 21, 2016<br \/>\nFirst published: October 21, 2016<br \/>\nBy Brett M. Christensen<br \/>\n<a class=\"foot\" href=\"http:\/\/www.hoax-slayer.com\/about.shtml\">About Hoax-Slayer<\/a><\/p>\n<p class=\"ref\">References<br \/>\n<a title=\"ATO 'Tax Refund Notification' Phishing Scam Email\" href=\"http:\/\/hoax-slayer.net\/ato-tax-refund-notification-phishing-scam-email\/\">ATO &#8216;Tax Refund Notification&#8217; Phishing Scam Email<\/a><br \/>\n<a title=\"ATO ' Tax Agent Report' Malware Email\" href=\"http:\/\/www.hoax-slayer.com\/ato-delayed-tax-returns-malware.shtml\">ATO &#8216; Tax Agent Report&#8217; Malware Email<\/a><br \/>\n<a title=\"ATO Tax Refund Malware Emails\" href=\"http:\/\/www.hoax-slayer.com\/ato-tax-refund-malware-emails.shtml\">ATO Tax Refund Malware Emails<\/a><\/p>\n<p><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script><br \/>\n<!-- HS Net Primary Matched Content --><br \/>\n<ins class=\"adsbygoogle\" style=\"display: block;\" data-ad-client=\"ca-pub-0355887770822260\" data-ad-slot=\"2703041438\" data-ad-format=\"autorelaxed\"><\/ins><br \/>\n<script>\n(adsbygoogle = window.adsbygoogle || []).push({});\n<\/script><\/p>\n<p><\/br><\/br> Original Source : <a href=\"https:\/\/www.hoax-slayer.net\/ato-right-to-obtain-a-refund-malware-emails\/\" target=\"_blank\">https:\/\/www.hoax-slayer.net\/ato-right-to-obtain-a-refund-malware-emails\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Outline: Emails purporting to be from the Australian Taxation Office (ATO) claim that you have \u00a0the right to obtain a refund or reimbursement and should therefore click a link to download more information. Brief \u00a0Analysis: The emails are not from the ATO and the promised refund does not exist. It is a criminal ruse designed [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":6890,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-959","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hoax-inggris"],"_links":{"self":[{"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/posts\/959"}],"collection":[{"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=959"}],"version-history":[{"count":0,"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/posts\/959\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/media\/6890"}],"wp:attachment":[{"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=959"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=959"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=959"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}