has been hacked, change your password ASAP

[iceruam]

I have seen hundreds of these emails, it is obvious that this is spam, why are they getting through with a score of 0?


Hello,

As you may have noticed, I sent this email from your email account (if you didn't see, check the from email id). In other words, I have fullccess to your email account.

I infected you with a malware a few months back when you visited an adult site, and since then, I have been observing your actions.

The malware gave me full access and control over your system, meaning, I can see everything on your screen, turn on your camera or microphon and you won't even notice about it.

I also have access to all your contacts.

Why your antivirus did not detect malware?
It's simple. My malware updates its signature every 10 minutes, and there is nothing your antivirus can do about it.

I made a video showing both you (through your webcam) and the video
you were watching (on the screen) while satisfying yourself.
With one click, I can send this video to all your contacts (email, social network, and messengers you use).

You can prevent me from doing this.
To stop me, transfer $986 to my bitcoin address.
If you do not know how to do this, Google - "Buy Bitcoin".

My bitcoin address (BTC Wallet) is 1JYn9ayLDQdQSXKWkPECugjShKYqWzm7LA

After receiving the payment, I will delete the video,
and you will never hear from me again.
You have 48 hours to pay. Since I already have access to your system
I now know that you have read this email, so your countdown has begun.

Filing a complaint will not do any good
because this email cannot be tracked.
I have not made any mistakes.

If I find that you have shared this message with someone else, I will immediately send the video to all of your contacts.

Take care

[jcoffin]

What is the SPAM event show for this email? /admin/index.do#reports?cat=spam-blocker&rep=all-email-events

[MechanicalThinker]

These emails also get past O365 spam filter even though we do not see hundreds of them, just occasionally. I think the reason is that there's not much wrong with them. There's no links or anything other suspicious about those emails. They are just simple text messages. So as long as the senders reputation is not flagged they will probably get through.

[sky-knight]

For me a good portion of these messages come with blob.core.windows.net links in them, so I have mailflow rules there to nuke all of those.

But the above? Users forward them to me from time to time, no attachments, no links... not much to make an automatic decision on, but it also means the user has to be smart enough to use a bitcoin wallet, but dumb enough to fall for the scam. Thus far, all I've been getting are users confused as to how to get a bitcoin wallet.

I suppose this will be a larger problem in the future if more people start using bitcoin.

I suppose you COULD filter based on bitcoin, and BTC Wallet, but that might be an issue in the future.

[iceruam]

On further examination it looks as though they made it look like it was coming from our mail server.

[sky-knight]

Well then, why is your server accepting unauthenticated mail from authoritative domains? That's something it shouldn't do!

And something you can and should fix!

[KnightWolf]

We've been seeing more of these recently too. They do get past O365, Google, and even our 3rd party spam filter.

I've looked at the headers for quite a few of these, they're not being relayed by the real mail server but are coming from compromised servers. In a lot of the cases they seem to be from compromised wordpress sites or poorly configured mail relays. They're basically spoofing the header.

Whats interesting is we & most of our clients have spf records with hard fail and they still seem to slip through occasionally.

[jcoehoorn]

I've looked at the headers for quite a few of these, they're not being relayed by the real mail server but are coming from compromised servers.

This doesn't matter. You know who the authorized senders are for your domain, and you can configure those server to reject messages that claim to originate with your domain but don't actually come from one of those authorized servers.

Probably the best way to accomplish this is to making sure all of your authorized servers DKIM sign their messages, and then publish a DKIM Reject policy in DNS for anything that's not signed. This can also produce a nice bump in your spam score, such that messages your organization sends to others are also much more likely to reach their destinations.

[sky-knight]

I suppose, now is the time to give away more valuable information...

So, if you're using Exchange 2016+ or Office 365, you need to open your admin panel for exchange, click mail flow on the left and make a new rule.

Name: Email Spoof Protection
Apply this rule if: Outside the organization
The sender's domain is: thedomainyougetmailon.com
Do the following: Generate incident report and send it to... whatever mailbox you want to get these reports
AND
Deliver the message to the hosted quarantine
Except if: Feed this a list of /32 IP addresses you want to be able to send without authenticating, I use these so MOPIERS can scan to mail without mucking about with authenticating, it removes support tickets.
or
The sender's domain is: Insert list service domains that send on your behalf so your people can get the test mails.

Everyone should have such a rule... EVERYONE. And yeah, if you use Exchange via O365 and you don't have DKIM setup, you need to do that too, it's two DNS records... chop chop!

You can see here an example of this rule protecting an O365 user from the sort of spam listed in this OP, on Friday 5-17

This email was automatically generated by the Generate Incident Report action.
Message Id: <[email protected]>
Sender: [email protected]
Subject: Hackers know password from your account. Password must be changed now.
Recipients: [email protected]
To: [email protected]

Properly configured mail servers > than spam filtration... these things don't happen by accident, it's our job to get it done people.

Oh and when you're making the mail flow rule don't forget to click the more options link at the bottom... FIRST... bad UI is bad, but that's the way it is.

But the bottom line is, no mail server should ever accept a message "from" a domain it's authoritative for, unless it's via an authenticated session. If it does, you open this door. Now you can't actually close this with O365, but you can use the rule above to ensure the messages are quarantined. You can also use this on more recent on premise Exchange servers instead of locking out things at the connector level, this provides some visibility.