Spam and phishing mail

“I want your clothes, shoes, and motorbike”

It’s a classic type of network fraud: you receive a letter asking you to send the login and password for your e-mail/online wallet/gaming account/etc. If you fail to comply, the phoney “support service” that sent the message threatens to limit or even block your access to the service.

Today our spam traps detected a letter like this in which the fraudsters were trying to swindle users out of out their activation codes for…Kaspersky Lab products! However, that’s not all – they also wanted to know the recipient’s residential address, mobile phone number and credit card number. They only stopped short of asking for the house keys.

“Dear User! Thank you for choosing our products. Unfortunately, recently more and more hackers have tried to use our name to steal information! Kaspersky Lab always cares about your security therefore we believe it is necessary to inform you about new malware! Please be informed that we have carried out preventive measures aimed at combating hackers! To confirm that you are using our licensed product please send us your full activation code information. Please also send your residence address, mobile phone number, credit card number (in order to pay for a license extension). Otherwise, our company will have to impose severe sanctions, including blocking access to your operating system.
Best regards, Kaspersky Lab.”

Hopefully, our users are not naïve enough to fall for such a primitive scam. There’s no need to explain that Kaspersky Lab would never send out letters like this, especially such threatening messages. It’s nothing more than a crude attempt to obtain some confidential data from some unsuspecting user.

To be fair, the letter does contain a number of true statements. For instance, it states that hackers make use of our name, which they do. And the authors state that Kaspersky Lab cares about the security of its users. That’s also true.

“I want your clothes, shoes, and motorbike”

Your email address will not be published. Required fields are marked *



APT trends report Q2 2021

This is our latest summary of advanced persistent threat (APT) activity, focusing on significant events that we observed during Q2 2021: attacks against Microsoft Exchange servers, APT29 and APT31 activities, targeting campaigns, etc.

LuminousMoth APT: Sweeping attacks for the chosen few

We recently came across unusual APT activity that was detected in high volumes, albeit most likely aimed at a few targets of interest. Further analysis revealed that the actor, which we dubbed LuminousMoth, shows an affinity to the HoneyMyte group, otherwise known as Mustang Panda.

WildPressure targets the macOS platform

We found new malware samples used in WildPressure campaigns: newer version of the C++ Milum Trojan, a corresponding VBScript variant with the same version number, and a Python script working on both Windows and macOS.

Ferocious Kitten: 6 years of covert surveillance in Iran

Ferocious Kitten is an APT group that has been targeting Persian-speaking individuals in Iran. Some of the TTPs used by this threat actor are reminiscent of other groups, such as Domestic Kitten and Rampant Kitten. In this report we aim to provide more details on these findings.

Subscribe to our weekly e-mails

The hottest research right in your inbox