{"id":270937,"date":"2018-08-06T09:31:12","date_gmt":"2018-08-06T07:31:12","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=270937"},"modified":"2018-08-06T09:32:20","modified_gmt":"2018-08-06T07:32:20","slug":"new-scam-email-targets-absa-and-mweb-clients","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/270937-new-scam-email-targets-absa-and-mweb-clients.html","title":{"rendered":"New scam email targets Absa and MWEB clients"},"content":{"rendered":"<p>MWEB and Absa clients have been targeted in a new email phishing attack, where they are asked to open an attachment aimed at stealing their private information.<\/p>\n<p>The email asks users to open an HTML attachment, which in turn opens a form in a browser which steals the victim\u2019s personal details.<\/p>\n<p>In the past, executable keyloggers were attached to emails to steal account information from victims.<\/p>\n<p>However, most security services now block users from opening an attached executable file, as most of these files are malicious.<\/p>\n<p>Scammers are now using HTML pages as attachments, where users are asked to provide their personal details in what appears to be a legitimate website.<\/p>\n<p>In these scams, users are encouraged to open the attached email file, which opens in a browser and requests their username and password for a service.<\/p>\n<p>This information is then sent to the criminal\u2019s email address using a basic PHP script.<\/p>\n<h3 class=\"my-4\">MWEB and Absa scam email<\/h3>\n<p>This is the method used in the latest email scam which is targeting MWEB and Absa clients.<\/p>\n<p>The email, which claims to come from MWEB &#8211; but is sent from \u201cinfo@mailsynk.co.za\u201d &#8211; tells users that their \u201cinvoices and\/or receipts and statement that you requested attached to this email\u201d.<\/p>\n<p>The attachment is the phishing page, which in this case uses the domain \u201cjehovalchristofficeinternatona.co.za\u201d to host the scripts.<\/p>\n<p>Without looking at the HTML code, there are many warning signs that this is a scam email:<\/p>\n<ul>\n<li>The email does not come from MWEB or Absa. It should be noted that an email which comes from an @mweb.co.za or @absa.co.za does not automatically mean it is authentic.<\/li>\n<li>The email is poorly structured and contains poor grammar.<\/li>\n<li>There is no personalisation in the email, with a user&#8217;s name or account details.<\/li>\n<li>It mentions a PDF file, but the attachment is a .htm file.<\/li>\n<li>Users are asked to provide their personal details to view a file &#8211; a clear sign it is a phishing attack.<\/li>\n<\/ul>\n<hr \/>\n<h3 class=\"my-4\">The Absa and MWEB phishing email<\/h3>\n<p><a href=\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2018\/08\/Scam-Email.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-270943\" src=\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2018\/08\/Scam-Email.jpg\" alt=\"Scam Email\" width=\"640\" height=\"1109\" srcset=\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2018\/08\/Scam-Email.jpg 709w, https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2018\/08\/Scam-Email-231x400.jpg 231w, https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2018\/08\/Scam-Email-248x430.jpg 248w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/a><\/p>\n<hr \/>\n<h3 class=\"my-4\">Now read:\u00a0<a href=\"https:\/\/mybroadband.co.za\/news\/security\/268349-beware-new-look-absa-scam.html\">Beware new-look Absa scam<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"<p>A new email scam, which claims to come from MWEB, is targeting Absa and MWEB clients.<\/p>\n","protected":false},"author":23,"featured_media":267837,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[2186,35,213],"class_list":["post-270937","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-absa","tag-headline","tag-mweb"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/270937"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=270937"}],"version-history":[{"count":2,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/270937\/revisions"}],"predecessor-version":[{"id":270947,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/270937\/revisions\/270947"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/267837"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=270937"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=270937"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=270937"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}