Week 12 in review

29.03.2021 - The number of reports received by the NCSC was slightly higher last week. Reports involving fake sextortion are on the rise again. The other most frequently reported incidents were phishing emails and fake support calls. Particularly striking were emails purportedly advertising bitcoin investments, as well as apparent attempts to deliver parcels accompanied by a phone call aimed at installing malware.

Mass advertising mails about apparent investment fraud

Since last Friday, the NCSC has been receiving a lot of reports on unsolicited emails whose subject line refers to an unpaid bill, an outstanding debt or a press release. However, the actual mail contains only a combination of letters and numbers, together with an urgent request to click on the link. If people follow the link, a Google search opens with predefined search terms. The first, and only, search result is a Russian website which advertises in German for bitcoin investments.

The NCSC recommends that you ignore and delete these emails. The random combinations of letters and numbers are probably designed to fool spam filters.

Example of a spam email with a link to a Google search

Dial M for malware

Over the past few weeks, there have been repeated reports of malware emails which are often accompanied by a telephone call from a company called Swiss Express Service (or similar). The company puts the call recipients under pressure to sign the supposed shipping documents, and informs them during the call that the papers will be sent by email. The attackers use this method to try to infect a computer with malware which is hidden behind the link in the PDF document. Different kinds of malware can be sent. In most cases, it is an e-banking Trojan. Interestingly, the calls in German are made by a real person, while a computer-generated voice is used for the French calls. It seems that the attackers' French skills were lacking and they were forced to seek an alternative.

Last modification 29.03.2021