Story image

Ezi Office Supplies site compromised in email phishing attack

06 Mar 2018

People who receive an email from Ezi Office Supplies should proceed with extreme caution as hackers may have taken over the company’s domain to spread malware.

The invoice email, appearing to be from Ezi Office Supplies, asks recipients to view their bill. Anyone who clicks the link is taken to a zipped file on the genuine Ezi Office Supplies website.

Those who download the file and unzip the file will then be hit with a JavaScript-based malware.

The sender, ‘account@eziofficesupplies.com.au’, also uses the genuine domain name, suggesting that the entire company’s website may have been compromised by hackers.

“On Feb 20 Ezi Office Supplies went on social media to warn their customers that they had been having problems with their email system. A post on the company’s Facebook feed stated 'If you have received an email from us - digitalenquiries please delete as it is a spam. Apologies if received already. Thank you’,” MailGuard explains.

People who receive an email from Ezi Office Supplies should proceed with extreme caution.

MailGuard has also detected a new type of phishing scam designed to mimic a Dropbox notification email.

The zero-day email scam displays the Dropbox logo to seem authentic – a common tactic used by cybercriminals to disguise their phishing attacks, explains Emmanuel Marshall in a MailGuard blog.

This time the message tells recipients that “You Have Received (5) pdf files sent to you via dropbox” and directs them to a link to access their files.

To add further urgency, the email says that the “file Will be deleted on = 5 March, 2018”.  It also uses Dropbox’s genuine PO Box details.

The email appears to originate from a person apparently called Dr()p-B()x!!  with the email address Holli@ccmech.com. The subject line, ‘Scan654464-87555!’ also appears.

According to Marshall, when recipients click the link to access the bogus files, they are taken to fake login pages that look like the real Dropbox website. Attackers then harvest login details.

Login harvesting is popular because attackers can then use the hacked Dropbox accounts to store malicious files. They could also sell the logins to other buyers who could then access genuine Dropbox documents as a means to conduct identity theft.

Telltale signs of email scams, according to MailGuard:

  • Generic greetings, such as ‘dear customer’
  • A sense of urgency, e.g. “ensure your invoice is paid by the due date to avoid unnecessary fees”
  • Bad grammar or misuse of punctuation and poor-quality or distorted graphics (this attempt isn’t let down by bad grammar, making it more likely some people will take the bait)
  • An instruction to click a link to perform an action (hover over them to see where you’re really being directed).
Microsoft urges organisations to tackle data blindspots
Despite significant focus placed on CX transformation, over a third of Australian organisations claimed that more than one in five of their projects failed.
Raising the stakes: McAfee’s predictions for cybersecurity
Security teams and solutions will have to contend with synergistic threats, increasingly backed by artificial intelligence to avoid detection.
Renesas develops 28nm MCU with virtualisation-assisted functions
The MCU features four 600 megahertz CPUs with a lock-step mechanism and a large 16 MB flash memory capacity.
DOCOMO ranked world's top mobile operator in 5G SEP applications
NTT DOCOMO has been ranked the world's leading mobile operator in terms of applications for candidate standard-essential patents.
Exclusive: Ping Identity on security risk mitigation
“Effective security controls are measured and defined by the direct mitigation of inherent and residual risk.”
CylancePROTECT now available on AWS Marketplace
Customers now have access to CylancePROTECT for AI-driven protection across all Windows, Mac, and Linux (including Amazon Linux) instances.
Gartner’s top 10 data and analytics trends for 2019
Data is the fuel for the modern world, and analytics the engine. Gartner has compiled the top 10 trends to watch this year.
How CIOs can work with colleagues to drive new competitive advantages
"If recent history has taught us anything, it’s that the role of the CIO is always changing, and that it won’t stop changing anytime soon."