Last week I was jolted with a mail that says:
My first reaction was: "Did I ever interview or converse with any such person? Then why am I receiving this email?". I immediately began analyzing the email and found that it is nothing but a variant of a Hitman spam which tries to threaten the user after initiating a conversation and then extorts money in the bargain.
The discussed spam mail is a reply to an email thread which was never received or replied to before. (Although the spam message says that the recipient was part of the email communication sent a few months back.) The email comes with an attachment containing the candidate’s resume. Suprisingly, the attachment has no malicious threats. However, a user should never click on attachments or links in unsolicited emails from unknown senders.
Further, the email threatens the recipient with dire consequences if money is not paid back. The personalized email thread and the attached CV gives the email a legitimate look. However, the email message has several typos and spelling mistakes in it.
The spam email is shown below:
At the moment, the motivation behind this attack is two pronged: to collect personal information and to extort money from the recipient. This modus operandi is similar to the Hitman spam. However, looking at the way this email is crafted and personalized we can anticipate many similar instances of specific, targeted attacks.
Please note that providing any personal information in response to an unsolicited email can compromise your identity and make you vulnarable to identity theft.
So, what should be done to break this vicious circle?
- Do not respond to someone you do not know
- If you feel the compulsion to respond, check if the sender is authentic
- Upgrade to Symantec message security software and use the latest signatures to block such spam