{"id":1547,"date":"2019-04-06T19:33:41","date_gmt":"2019-04-06T19:33:41","guid":{"rendered":"http:\/\/www.syyhoaxanalyzer.com\/?p=1547"},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-29T17:00:00","slug":"Fake-UPS-Invoice-Email-Links-to-Macro-Malware-Download","status":"publish","type":"post","link":"https:\/\/www.syyhoaxanalyzer.com\/?p=1547","title":{"rendered":"Fake UPS Invoice Email Links to Macro Malware Download"},"content":{"rendered":"<div>\n<p>According to this email, which purports to be from \u00a0American package delivery company United Parcel Service (UPS), your new invoice is now available. \u00a0 <\/p>\n<p><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script><br \/>\n<!-- HS Net Top Content Responsive --><br \/>\n<ins class=\"adsbygoogle\"\n     style=\"display:block\"\n     data-ad-client=\"ca-pub-0355887770822260\"\n     data-ad-slot=\"4870821038\"\n     data-ad-format=\"auto\"><\/ins><br \/>\n<script>\n(adsbygoogle = window.adsbygoogle || []).push({});\n<\/script><\/p>\n<p>It urges you to download the invoice from the UPS Billing Center to view and pay the bill. The email includes the UPS logo and colour scheme and at least at first glance, may appear to be a genuine UPS notification.<\/p>\n<p>However, the email is not from UPS and clicking the link will not download an invoice as claimed.<\/p>\n<p>Instead, clicking the link downloads a .zip file that contains a seemingly innocuous Microsoft Word document.<\/p>\n<p>When you attempt to open the Word document, you will be prompted to enable macros, \u00a0 supposedly for security reasons. If you do enable macros, a malicious macro will then download and install further malware.<\/p>\n<hr \/>\n<style>\n\t\t\t\t\t#wpsm_accordion_19216 .wpsm_panel-heading{\npadding:0px !important;\n}\n#wpsm_accordion_19216 .wpsm_panel-title {\nmargin:0px !important; \ntext-transform:none !important;\nline-height: 1 !important;\n}\n#wpsm_accordion_19216 .wpsm_panel-title a{\ntext-decoration:none;\ncolor:#000000 !important;\nfont-size:18px !important;\ndisplay:block;\npadding:0px;\nfont-family: Open Sans !important;\npadding-top: 10px;\npadding-bottom: 10px;\nborder-bottom:1px solid  #ddd !important;<\/p>\n<p>}\n#wpsm_accordion_19216 .wpsm_panel-title a:hover,#wpsm_accordion_19216 .wpsm_panel-title a:visited, #wpsm_accordion_19216 .wpsm_panel-title a:focus {\n\tcolor:#000000 !important;\n}\n#wpsm_accordion_19216 .acc-a{\n\tcolor: #000000 !important;\n\tbackground-color:#7dcec9 !important;\n\tborder-color: #ddd;\n}\n#wpsm_accordion_19216 .wpsm_panel-default > .wpsm_panel-heading{\n\tcolor: #000000 !important;\n\tbackground-color: #7dcec9 !important;\n\tborder-color: #7dcec9 !important;\n\tborder-top-left-radius: 0px;\n\tborder-top-right-radius: 0px;\n}\n#wpsm_accordion_19216 .wpsm_panel-default {\n\t\tborder:0px solid transparent !important;\n\t}\n#wpsm_accordion_19216 {\n\tmargin-bottom: 20px;\n\toverflow: hidden;\n\tfloat: left;\n\twidth: 100%;\n\tdisplay: block;\n}\n#wpsm_accordion_19216 .ac_title_class{\n\tdisplay: inline-block;\n    padding-top: 5px;\n    padding-bottom: 5px;\n    padding-left: 13px;\n    padding-right: 10px;\n    border: 0px solid #ddd;\n\tfont-size:18px !important;\nfont-family: Open Sans !important;<\/p>\n<p>}\n#wpsm_accordion_19216  .wpsm_panel {\n\toverflow:hidden;\n\t-webkit-box-shadow: 0 0px 0px rgba(0, 0, 0, .05);\n\tbox-shadow: 0 0px 0px rgba(0, 0, 0, .05);<\/p>\n<p>\t\tborder-radius: 4px;\n\t}\n#wpsm_accordion_19216  .wpsm_panel + .wpsm_panel {\n\t\tmargin-top: 0px;\n\t}\n#wpsm_accordion_19216  .wpsm_panel-body{\nbackground-color:#e2e2e2 !important;\ncolor:#000000 !important;\nborder-top-color: #7dcec9 !important;\nfont-size:16px !important;\nfont-family: Open Sans !important;\noverflow: hidden;<\/p>\n<p>border: 0px solid #ddd !important;<\/p>\n<p>border-top:0px !important;\n}<\/p>\n<p>#wpsm_accordion_19216 .ac_open_cl_icon{\n\tbackground-color:#dd3333;\n\tcolor: #ffffff;<\/p>\n<p>     padding-top: 5px; \n     padding-bottom: 5px; \n\t margin-left:10px;\n    line-height: 1.0;\n    font-size:18px !important;\ntext-align: center !important;\n     width: 32px !important;\n    display: inline-block;<\/p>\n<p>}\n#wpsm_accordion_19216 .ac_open_cl_number{\n width: 25px !important;\n    display: inline-block;\n\t margin-left:10px;\n\t text-align: center !important;\n\t font-size:18px !important;<\/p>\n<p>}<\/p>\n<p>\t\t\t #wpsm_accordion_19216 .wpsm_panel-heading {\n\t\t\t\tbackground-image: url(https:\/\/www.hoax-slayer.net\/wp-content\/plugins\/faq-responsive\/assets\/images\/style-soft.png);\n\t\t\t\tbackground-position: 0 0;\n\t\t\t\tbackground-repeat: repeat-x;\n\t\t\t}\n\t\t\t#wpsm_accordion_19216 .ac_open_cl_icon{\n\t\t\t\tbackground-image: url(https:\/\/www.hoax-slayer.net\/wp-content\/plugins\/faq-responsive\/assets\/images\/style-soft.png);\n\t\t\t\tbackground-position: 0 0;\n\t\t\t\tbackground-repeat: repeat-x;\n\t\t\t}<\/p>\n<\/style>\n<div class=\"wpsm_panel-group\" id=\"wpsm_accordion_19216\" >\n<p>\t\t\t\t  <!-- Inner panel Start --><\/p>\n<div class=\"wpsm_panel wpsm_panel-default\">\n<div class=\"wpsm_panel-heading\" role=\"tab\" >\n<h4 class=\"wpsm_panel-title\">\n\t\t\t\t\t\t<a  class=\"\"  data-toggle=\"collapse\" data-parent=\"#wpsm_accordion_19216 \" href=\"#ac_19216_collapse1\"  ><br \/>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"ac_title_class\"><br \/>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span style=\"margin-right:6px;\" class=\"fa fa-lightbulb-o\"><\/span><br \/>\n\t\t\t\t\t\t\t\tToggle to read more about macros\t\t\t\t\t\t\t<\/span><br \/>\n\t\t\t\t\t\t<\/a><br \/>\n\t\t\t\t\t  <\/h4>\n<\/p><\/div>\n<div id=\"ac_19216_collapse1\" class=\"wpsm_panel-collapse collapse_19216 collapse \"  >\n<div class=\"wpsm_panel-body\">\n<div class=\"indentPara\">For those that may not be aware, a macro is a set of commands and instructions that can be collected as a single command in order to quickly and automatically accomplish a task.<\/p>\n<p>Complex macros can be created using VBA (Visual Basic for Applications) and can be very helpful in some workflows.<\/p>\n<p>But malicious VBA macros can also be created and distributed. In years gone by, macro viruses were common computer security threats. But, for the last several years, they have been much less significant due to the fact that later versions of Microsoft Office disabled macros by default and implemented other security measures.<\/p>\n<p>However, criminals have apparently realized that many computer users will have forgotten about or have no knowledge of macro threats. Thus, \u00a0<a title=\"Remember macro viruses? Infected Word and Excel files? They're back...\" href=\"http:\/\/nakedsecurity.sophos.com\/2014\/07\/07\/remember-macro-viruses-infected-word-and-excel-files-theyre-back\/\">malicious macros are again being used<\/a> \u00a0to spread malware. \u00a0<\/p>\n<p>In modern incarnations of the threat, criminals do not try to subvert in-built security systems but use simple social engineering techniques to get users to allow the macros to run. The criminals rely on the curiosity of recipients who may proceed without due caution in the hope of finally viewing the promised document content.<\/p>\n<p>Unless you have a compelling reason, you would be best to leave macros disabled by default. And do not believe any message that claims that you must enable macros to view or interact with Microsoft Office documents.\t\t\t\t\t  <\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<p>\t\t\t\t   <!-- Inner panel End --><\/p><\/div>\n<p>\t\t\t\t<script>\n\tjQuery(document).ready(function() {<\/p>\n<p>\t\t\tjQuery('.collapse_19216').on('shown.bs.collapse', function(){jQuery(this).parent().find(\".fa-plus\").removeClass(\"fa-minus\").addClass(\"fa-minus\"); jQuery(this).parent().find(\".wpsm_panel-heading\").addClass(\"acc-a\"); }).on('hidden.bs.collapse', function(){jQuery(this).parent().find(\".fa-minus\").removeClass(\"fa-minus\").addClass(\"fa-plus\"); jQuery(this).parent().find(\".wpsm_panel-heading\").removeClass(\"acc-a\");});<\/p>\n<p>\t\t});\n\t<\/script><\/p>\n<p>This malware may be ransomware that locks your computer files and then demands that you pay a fee to the scammers to receive an unlock key. Or, the malware may be designed to steal information such as banking passwords from the infected computer. \u00a0<\/p>\n<p><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script><br \/>\n<ins class=\"adsbygoogle\"\n     style=\"display:block; text-align:center;\"\n     data-ad-format=\"fluid\"\n     data-ad-layout=\"in-article\"\n     data-ad-client=\"ca-pub-0355887770822260\"\n     data-ad-slot=\"9162856233\"><\/ins><br \/>\n<script>\n     (adsbygoogle = window.adsbygoogle || []).push({});\n<\/script><\/p>\n<p>Online criminals have been <a href=\"https:\/\/www.hoax-slayer.net\/not-able-to-deliver-ups-package-malware-email\/\">distributing malware via bogus UPS notification emails<\/a> for a number of years. Be wary of any email that claims to be from UPS and urges you to click \u00a0a link or open an attached file to deal with a supposed delivery error, pay a bill, or update account details.<\/p>\n<p>UPS has <a href=\"https:\/\/www.ups.com\/us\/en\/help-center\/legal-terms-conditions\/fight-fraud.page?\">information about recognising and reporting such fraudulent emails<\/a> on its website.<\/p>\n<p>Note that criminals use the names of other well-known delivery companies around the world in very similar \u00a0malware campaigns.<\/p>\n<div class=\"example\">\n<h2>An example of the malware email:<\/h2>\n<p><a href=\"https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2018\/04\/ups-invoice-malware-04042018-1.jpg\" data-rel=\"penci-gallery-image-content\" ><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"19453\" data-permalink=\"https:\/\/www.hoax-slayer.net\/fake-ups-invoice-links-to-macro-malware-download\/ups-invoice-malware-04042018-1\/\" data-orig-file=\"https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2018\/04\/ups-invoice-malware-04042018-1.jpg\" data-orig-size=\"800,549\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"ups-invoice-malware-04042018-1\" data-image-description=\"\" data-medium-file=\"https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2018\/04\/ups-invoice-malware-04042018-1-300x206.jpg\" data-large-file=\"https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2018\/04\/ups-invoice-malware-04042018-1.jpg\" class=\"aligncenter size-full wp-image-19453\" src=\"https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2018\/04\/ups-invoice-malware-04042018-1.jpg\" alt=\"UPS Invoice Malware Email\" width=\"800\" height=\"549\" srcset=\"https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2018\/04\/ups-invoice-malware-04042018-1.jpg 800w, https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2018\/04\/ups-invoice-malware-04042018-1-300x206.jpg 300w, https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2018\/04\/ups-invoice-malware-04042018-1-768x527.jpg 768w, https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2018\/04\/ups-invoice-malware-04042018-1-500x343.jpg 500w, https:\/\/www.hoax-slayer.net\/wp-content\/uploads\/2018\/04\/ups-invoice-malware-04042018-1-585x401.jpg 585w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/a><\/p>\n<\/div>\n<p><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script><br \/>\n<!-- Third Content Ad Responsive --><br \/>\n<ins class=\"adsbygoogle\"\n     style=\"display:block\"\n     data-ad-client=\"ca-pub-0355887770822260\"\n     data-ad-slot=\"1909104632\"\n     data-ad-format=\"auto\"><\/ins><br \/>\n<script>\n(adsbygoogle = window.adsbygoogle || []).push({});\n<\/script><\/p>\n<div align=\"center\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script><br \/>\n<!-- HS Net Bottom AdLinks --><br \/>\n<ins class=\"adsbygoogle\" style=\"display: block;\" data-ad-client=\"ca-pub-0355887770822260\" data-ad-slot=\"1358951439\" data-ad-format=\"link\"><\/ins><br \/>\n<script>\n(adsbygoogle = window.adsbygoogle || []).push({});\n<\/script><\/div>\n<p><\/br><\/br> Original Source : <a href=\"https:\/\/www.hoax-slayer.net\/fake-ups-invoice-links-to-macro-malware-download\/\" target=\"_blank\">https:\/\/www.hoax-slayer.net\/fake-ups-invoice-links-to-macro-malware-download\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>According to this email, which purports to be from \u00a0American package delivery company United Parcel Service (UPS), your new invoice is now available. \u00a0 It urges you to download the invoice from the UPS Billing Center to view and pay the bill. The email includes the UPS logo and colour scheme and at least at [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":6890,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1547","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hoax-inggris"],"_links":{"self":[{"href":"https:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/posts\/1547"}],"collection":[{"href":"https:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1547"}],"version-history":[{"count":0,"href":"https:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/posts\/1547\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=\/wp\/v2\/media\/6890"}],"wp:attachment":[{"href":"https:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1547"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1547"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.syyhoaxanalyzer.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1547"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}