Things I See

Phish email pretending to be an invoice.

Directs people to a page hosted on FlipSnack which pretended to be an encrypted Office 365 document requiring login.

Received from compromised account on domain pac-technologies.com.au

Subject: JPS Bill – A/C#: 1109802-934617 Amount: $95,154.06 Due Date: 25-JUL-2020

Phishing link in the email:
https://www.flipsnack.com/templateportal/remittance/full-view.html

and on clinking on fake document directs to:
https://egletek.com/wp-admin/images/theme/template/office

Phish email pretending to webmail spam notification email.

Received from vegaviajeros.com
From: webmail – team <id>@vegaviajeros.com Using MailChimp Mailer

Subject: Important notification

Phishing domain in the email: https://onlineupdtportal.com/

Text used in the body of the email:

Dear webmail User

webmail has prevented the delivery of 7 new emails to your inbox
You can review these here and choose what happens to them

Phish email pretending to be a voicemail with attached .HTM file with encoded link.

Adds “Message Is From Authorized Access.” in a colored box at the top of the email which appears under the Microsoft or Google phish warnings to try to make it seem legitimate.

Received: angela@themaintco.com

Received: tony 138.91.126.15 via mrelayeu.kundenserver.de 213.165.67.99 and mout.kundenserver.de 212.227.126.130

Subject: NEW VM enclose 7 June, 2020

Attachment name: 📞AudioMessage 7 June, 2020_00190_673_66wav.htm

Body:

Hi <prefix of user email>,
You have a message from caller

Caller Number:: +1 512-403-2737
Device Name: <organisation domain> VMCentre-FX-2EFF73
Device Location: Frontdesk


This email was sent to <users email address>

Phish email pretending to be a sales order that has arrived by a Microsoft cloud looking Fax service. “Sign in to view your fax / E1 Document”

Received from compromised domains swingperfector.com & rosenkranz.co.uk
Dkim mentions CollinsBenefits.onmicrosoft.com

Subject: Sales Order Details From (61)(993)-373-3939 Doc.

Phishing link in the email: https://us10.campaign-archive.com/

Text used in the body of the email to make it appear less SPAMMY to filters:

Covid 19 update

All Saber Power Employees,

We would like to thank everyone for their excellent response to the pandemic we have all been experiencing.  Saber employees have always risen to meet our challenges head on, and this pandemic is no exception.   You have been measured and practical in your response.   Everyone’s willingness to adapt and react in support of our company, each other, and our clients we serve has been remarkable, and truly appreciated.

As you are all aware this pandemic and subsequent lockdown has caused enormous economic hardship to millions of people and companies.  We are very pleased that we have weathered this disruption with no layoffs or salary reductions.  Many companies including some of our competitors have been reducing pay, benefits, and hours.  While we are not completely out of the woods, we are extremely optimistic that we have accomplished our goal of not having any such reductions, resulting in a much stronger company going forward.  These remarkable results are a testament to the Saber team’s work ethic, culture, and can-do attitude.  Well done!

The challenge now is to continue to remain relevant to our customers while defining our new normal.   As we do that, we want to ask everyone to use common sense and keep practicing good hygiene and social etiquette.   Our next step under the new normal is to open our buildings back up on June 15th, at that time we will resume allowing vendors and customers full access to our buildings.   We will also resume offering training classes to our customers and employees on campus.  As always if circumstances change, we may adjust this plan.

The health and safety of our employees remains our core value.  We continue to ask all of you to self-monitor your health and if you feel ill or have an elevated temperature, stay home, contact your supervisor, and seek appropriate medical attention.

We hope everyone has gotten their 2-million-hour safety award cooler.  It should be a nice addition to your 1-million-hour rocking chair while at the beach, campsite, or back patio.  Let us all strive to maintain our safety focus and safe work culture, so we all return from work as well or better than we left home, and we can obtain  our 3-million-hour safety award.

As always stay safe,