“Your Amazon Order Has Shipped” Spam Leads to Malware

Did you receive an email stating that your Amazon order for an “Omron UAZ-016D Fat Loss Monitor” has shipped? Don’t click any links within that email!

Cybercriminals are actively spamming out fraudulent Amazon order shipment emails, hoping that you’ll follow the links to malware-laden websites.

Here’s a copy of the email:

From: Monte Mcintyre [serve@iztzg(dot)hr]
Sent: Friday, December 09, 2011 6:17 AM
Subject: Your Amazon.com order of "Omron UAZ-016D Fat Loss ..." has shipped!

Hello,

Shipping Confirmation
Order # 972-8332938-9078254

Your estimated delivery date is:
Tuesday, December 13, 2011

Track your package Thank you for shopping with us. We thought you'd like to know that we shipped this portion of your order separately to give you quicker service. You won't be charged any extra shipping fees, and the remainder of your order will follow as soon as those items become available. If you need to return an item from this shipment or manage other orders, please visit Your Orders on Amazon.com.

Shipment Details

Omron UAZ-016D Fat Loss Monitor, Black $119.95
Item Subtotal: $119.95
Shipping & Handling: $0.00
Total Before Tax: $119.95
Shipment Total: $119.95
Paid by Visa: $119.95

You have only been charged for the items sent in this shipment. Per our policy, you only pay for items when we ship them to you.

Returns are easy. Visit our .
If you need further assistance with your order, please visit Customer Service.

We hope to see you again soon!
Amazon.com

All of the links in the email lead to the same URL, which is hxxp://tecak-kovo[dot]sk/wp-content/uploads/fgallery/news.html.

Upon clicking the links, you will instantly be redirected to hxxp://certerpen.info/main.php?page=525447c096f8efbf, which is a blackhole exploit kit site that will attempt to install malware on your computer.

[Warning: The URLs I've listed above are actively delivering malware, so please do not visit them! They're only provided to help you spot future attacks.]

According to Conrad Longmore at Dynamoo, the malware attempting to make its way onto your PC is the Cridex Trojan.

Win32/Cridex is a nasty bug known for downloading additional malware, capturing your online banking information, stealing local certificates and uploading your files to a remote server.

Thankfully, threats like these can be easily avoided with the help of up-to-date antivirus software. ESET NOD32 Antivirus will stop you from following the links, although you shouldn’t be clicking links in spam emails anyway. ;)

Cybercriminals have been sending out a variety of Amazon-themed spam as of late; some of the spam hopes to collect your account information while others attempt to deliver malware via malicious file attachments.

Make sure that you warn your family and friends to about the influx of spam posing as legitimate Amazon emails and make sure you’re running antivirus on your PC!

Be sure to follow us on Twitter at @hyphenet or “Like” us on Facebook to stay up-to-date on the latest tech news and PC security alerts.

Photo Credit: hoyasmeg

Scammers Earning Money by Peddling Nonexistent Cell Snooping Software

Cellphones can reveal a lot about a person.

So it’s no surprise that some may be willing to browse through the text message or email inbox tied to the cellphone of their employees or spouses in hopes of curbing that paranoid feeling that they’re up to no good.

Those who don’t have the gall to personally invade someone else’s mobile privacy may turn to cellphone-targeting spyware built specifically to do the work for them. To no surprise, there’s a good chance that participating in such dishonest activities may backfire on you.

For instance, SMS Privato Spy is advertised an application that will allegedly grant access to the text messaging history, call logs, GPS history, and audio control of the smartphone that you plant it on.

Naturally, all of that functionality comes with a hefty price – the cheapest package available is $50 and that only grants you a month’s worth of spying on a single phone. If you’re serious about your snooping, you can opt for a pricey $125 package that offers unlimited eavesdropping on as many phones as you want for a year.

Karma will instantly turn around and bite anyone who plans on buying SMS Privato Spy, though. According to Peter Coogan at Symantec,

“The thing is there is no such product as SMS Privato Spy.”

Wannabe snoopers that go through the process of ordering SMS Privato Spy will get a voucher pin code from the online payment site, PaySafeCard, that they will then turn around and use in order to register and purchase SMS Privato Spy off the website.

Despite a large green checkmark and message saying your order is being processed being displayed upon a completed checkout, Coogan states, “No further contact is made with the victim and the scammers take the unprocessed payment voucher pin code and use it for their own purposes.”

Apparently the funds have been used to buy merchandise from an online gaming site.  As explained by Coogan in his post,

“The game in question is a hugely popular online game and the fraudsters may have being purchasing points that are used as an in game currency.  Although NOT condoned by the gaming company, there is an online black market where gamers can buy and sell these points for real money.  This may have been the intention of the fraudsters in an attempt to try and launder their ill-gotten, monetary gains.”

This should serve as a reminder that you should always exercise caution and research the product you’re interested in when purchasing goods online.

Be sure to follow us on Twitter at @hyphenet or “Like” us on Facebook to stay up-to-date on the latest tech news and PC security alerts.

Photo Credit: Digitpedia

Latest Facebook Scam Headline? "Demi Moore Catches Ashton Kutcher Cheating on Video"

Just in case the headline of Justin Bieber being stabbed wasn’t enough to catch your attention, cybercriminals have fabricated yet another story, this time they’re claiming that actress Demi Moore busted her soon-to-be ex-husband cheating on her with a stripper.

Why? Scammers make a commission off the online surveys people are all-too-willing to complete in hopes of viewing the alleged video.

Here’s the Facebook wall post reeling victims in:

DEMI MOORE CATCHES ASHTON KUTCHER CHEATING ON VIDEO
fpoefkefope[dot]info
The real reason Demi Moore is divorcing Ashton! Caught redhanded, cheating with a stripper

Keep in mind that more than one domain name is currently being used in this scam, which makes it difficult for Facebook to block users from sharing it since the blocks are URL based.

Upon clicking the link, you’re taken to a website that’s designed to give the impression you’re still on Facebook’s website when you’ve actually left it.

On the page is a fake video player that will demand that you share the page in order to view the video.



It’s not until after you expose your Facebook peers to this scam does it show its true colors.

Instead of playing the alleged film showing Ashton Kutcher get caught read-handed with a stripper, the page kicks you over to another site that asks you to “verify your identity” by taking odd-named surveys such as “Awesome Starbucks gift card!”, “iPhone 4S” or “Elitecelebrities.com” because that’s clearly what they were built for.



If you made the mistake of falling for this scam, you can reverse some of the damage by immediately removing any of the Facebook Wall posts that advertise it to your friends and replace it with a warning to avoid it.

Cybercrooks setup scams similar to this one to trick people into taking online surveys, spread malware, or harvest personal data that they then use to commit identity fraud or sell to the highest bidder.

Be cautious of the links you follow from social networking site and make sure you protect your PC by running up-to-date antivirus software that offers real-time scanning.

Stay safe, Facebookers!

Be sure to follow us on Twitter at @hyphenet or “Like” us on Facebook to stay up-to-date on the latest Facebook scams.

Photo of Demi Moore & Ashton Kutcher Credit: Amanda Edwards/WireImage.com

The Evolution of the Geek [INFOGRAPHIC]

Back in the 1500’s, the term “geek” meant fool, which is the total opposite of the passionate, information-driven individuals that consider themselves “geeks” today.

Apparently the term “geek” didn’t become code for those who are obsessed with a subject of their choosing until the 1950’s. Ever since, we’ve busied ourselves by branching out into different categories of geek.

Do you fit any of the geek molds? This nifty infographic by Flowtown will help you figure it out.

I’d say I’m balancing between internet and tech geek.



Geek it up with Hyphenet by following us @hyphenet on Twitter & liking us on Facebook!

Relax, Justin Bieber Wasn't Stabbed by a CRAZED Fan

For those of you that suffer from Bieber fever, look out! The scammers are coming for you.

Internet crooks that prefer to make an extra buck by tricking people into completing online surveys in hopes of unlocking hot gossip have launched a spam campaign on Facebook claiming that Justin Bieber was stabbed by a fan-gone-mad in L.A.

This is the message that’s luring folks in:

Justin Bieber STABBED by CRAZED Fan Outside L.A. NightClub!
jeanvidsonline.co.cc
OMG! NOOOO! Could YOU Even Imagine!

The cybercriminal behind the scam was smart enough to use multiple domains, which include jeanvidsonline.co.cc, uwuuuuuwi.co.cc and rihannavideo.co.cc, among others.  (As a side note, I can’t help but to find it amusing that they’re all “.co.cc” subdomains given the fact that Google recently delisted ALL .co.cc subdomains from their search results since bad guys love using them to promote spam and phishing scams similar to this one.)

If you find yourself unable to resist the urge to follow the link, you will be presented with a page that appears to have an embedded YouTube video. However, that pesky ‘Share’ button is present once again, demanding that you help keep the spam alive by posting it to your Facebook wall.



Unfortunately should you decide to do as you're told, you'll be redirected to a page that's hoping to take that inch and turn it into a mile by requesting that you complete one of their surveys to "verify your account."



Imagine the disappointment (and shame) you’d feel if you were actually gullible enough to complete one of the surveys only to find out that there was no video, Justin Bieber was never stabbed and you totally just fell for a survey scam.

Take it as a lesson learned and remove the post from your Wall to keep your Facebook friends from making the same mistake.

This isn’t the first time cybercriminals have conjured up some story in order to generate traffic and dupe people into taking online surveys.  Previous scams have attracted people in droves by claiming Lady Gaga was found dead in a hotel room, you’ll lose respect for Rihanna after watching some video and a story similar to this one saying Jeremy Kyle was attacked.

Proceed with caution when following links and be skeptical of stories (or offers) that request that you share them with everyone first. That’s a pretty big sign that you’re about to walk right into a scam.

Be sure to follow us on Twitter at @hyphenet or “Like” us on Facebook to stay up-to-date on the latest Facebook scams.

Facebookers, Say Hello to the $1,000 Costco Giftcard Scam

So far a whopping 11,600+ people have fell victim to the latest scam to hit Facebook (and counting!).

Thanks to the easy sharing capability offered by the popular social networking site, along with the trust users tend to attach to content shared by their friends, scams are capable of spreading like wildfire, exposing it’s victims to identity theft, additional scams, or even malware.

You can avoid becoming a statistic by not clicking any links in the following message should it pop-up in your News feed:

Get Costco Gift Card for FREE! (limited time only)
costcocards.info
Costco is currently giving away $1000.00 gift cards to all facebook users!!

For if you did grow curious enough to click the link, you will be taken to a page that says you can get a  $100 Costco gift card if you post the offer to your profile and like it.

If the fact that it’s asking you to share this opportunity before you even get it doesn’t alarm you, then perhaps a red flag will fly up once you realize that the original offer was for a $1,000 gift card, not a $100 one.

I guess the scammer couldn’t really keep their lie straight. Shocker.

Should you decide to ignore your instincts to stop there, upon sharing the scam with your friends, you will be taken to an entirely different website (grandholidaygiveouts.com) asking you to enter your email address.

However, once you enter your email address, you’ll be taken to another page that asks for a host of personal information, including your full name, address, date of birth, mobile and home phone numbers. Suddenly it seems like you’re selling your identity for a Costco gift card.

If you were expecting the interrogation to stop there, you’re wrong. Right after you complete that intrusive questionnaire, you’ll be kicked right over to another 5-minute survey that will likely be followed by another and another… and another…

See where this is headed?

Suffice it to say, you’re not really getting a FREE Costco gift card, if anything.

The terms and conditions of the site asking you to tell all states that you’ll have to complete a bunch of surveys and complete a total of 6 “reward offers” that usually involve you applying for a credit card (that you HAVE to make a purchase on or transfer a balance to) or signing up for a paid subscription service of some sort.

Of course, let’s not forget that scammers that collect mobile numbers have been known to sign the owner up for expensive SMS subscription services.

What should you do if you see the $100/$1,000 Costco gift card scam:

• Do NOT click any of the links or give out your personal details.


• Educate anyone that you see posting it to their Facebook walls that they are exposing their Facebook friends to a scam.

If you made the mistake of falling for this scam, you will want to be on high alert as the cybercriminals may send you more targeted scam campaigns to your home address or email, attempt to commit identity fraud, or sell your information to the highest bidder.

Be sure to follow us on Twitter at @hyphenet or “Like” us on Facebook to stay up-to-date on the latest Facebook scams.

Cybercrooks Handing Out Amazon-Flavored Spam Like It’s Candy

Many of us will be knocking out our holiday gift lists with the help of Amazon, so we’re likely to receive a number of emails from the largest online retailer.

Knowing this, cybercriminals are hard at work pumping out spam posing as official emails from Amazon in hopes of stealing your personal information or infecting your PC with malware.

You have (1) Message from Amazon

If you receive an email saying you have a message from Amazon that your account is about to expire, don’t bother opening it.

The spam message reads:

Subject: You have (1) Message from Amazon
Dear customer,

Your online account is about to expire and will be deactivated.

Please confirm wether you want to continue using Amazon or not.

If the answer is yes, download and complete the attached form.

If the answer is no, please ignore this e-mail.

Best wishes,
Amazon Team

Note - Do not reply to this e-mail.

According to Sophos, cybercrooks are hoping that you open the file attached, named NO003950033.html, which is a web form that’s anything but shy of asking for all of your personal details, including your name, address, phone number, birthdate and credit card information.

Although the form claims that divulging this personal information will prevent your Amazon account from being deactivated, it’s actually guaranteeing that the criminal mastermind behind this scam will have the means to knock out their Christmas wishlist. All thanks to your [credit card information] giving nature.

You’ve received an Amazon gift card! […Not!]

Beyond committing identity fraud, another favorite pastime of cybercriminals is planting malware on the machines of unsuspecting users.

That’s why in addition to the bogus Amazon account deactivation emails, internet scammers are also sending out spam disguised as an alert from Amazon stating you’ve received an Amazon gift card:

Subject: Your gift card order
From: Amazon

Dear customer, Amazon notification, You have received a gift card in the amount of $250 An offer of the gift card is valid until December 7. Take a chance and use our gift card, and as a bonus we will deliver your order free of charge. Your Amazon

As Troy Gill of AppRiver pointed out, the amount on the alleged gift card may vary, but the dangers lurking in the attached zip file (Gift_Card.zip) remain the same.

Contrary to the file name, Gift_Card.zip doesn’t contain an Amazon gift card, but a Trojan horse that will open up a backdoor on your machine and download additional malware. Surprise!

Don’t be fooled by Amazon Spam

With all of these spam emails going around, how can you tell what’s real and what’s not?

Amazon was kind enough to create a page to help you identify whether an email is from them, stating:

• Amazon doesn’t send unsolicited email attachments. (Feel free to forward “Amazon” emails with file attachments to stop-spoofing@amazon.com WITHOUT opening the attachment.)


• Amazon will never ask you for your social security, credit card information, mother’s maiden name or Amazon.com password.


• Amazon likes to proofread their emails before sending them, which is not a common practice for spammers.


• Amazon will never ask you to verify account information through a link in an email.

Stay safe, folks!

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.