Ezi Office Supplies site compromised in email phishing attack

People who receive an email from Ezi Office Supplies should proceed with extreme caution as hackers may have taken over the company's domain to spread malware.

The invoice email, appearing to be from Ezi Office Supplies, asks recipients to view their bill. Anyone who clicks the link is taken to a zipped file on the genuine Ezi Office Supplies website.

Those who download the file and unzip the file will then be hit with a JavaScript-based malware.

The sender, 'account@eziofficesupplies.com.au', also uses the genuine domain name, suggesting that the entire company's website may have been compromised by hackers.

"On Feb 20 Ezi Office Supplies went on social media to warn their customers that they had been having problems with their email system. A post on the company's Facebook feed stated 'If you have received an email from us - digitalenquiries please delete as it is a spam. Apologies if received already. Thank you'," MailGuard explains.

People who receive an email from Ezi Office Supplies should proceed with extreme caution.

MailGuard has also detected a new type of phishing scam designed to mimic a Dropbox notification email.

The zero-day email scam displays the Dropbox logo to seem authentic – a common tactic used by cybercriminals to disguise their phishing attacks, explains Emmanuel Marshall in a MailGuard blog.

This time the message tells recipients that "You Have Received (5) pdf files sent to you via dropbox" and directs them to a link to access their files.

To add further urgency, the email says that the "file Will be deleted on = 5 March, 2018".  It also uses Dropbox's genuine PO Box details.

The email appears to originate from a person apparently called Dr()p-B()x!!  with the email address Holli@ccmech.com. The subject line, 'Scan654464-87555!' also appears.

According to Marshall, when recipients click the link to access the bogus files, they are taken to fake login pages that look like the real Dropbox website. Attackers then harvest login details.

Login harvesting is popular because attackers can then use the hacked Dropbox accounts to store malicious files. They could also sell the logins to other buyers who could then access genuine Dropbox documents as a means to conduct identity theft.

Telltale signs of email scams, according to MailGuard:

• Generic greetings, such as 'dear customer'
• A sense of urgency, e.g. "ensure your invoice is paid by the due date to avoid unnecessary fees"
• Bad grammar or misuse of punctuation and poor-quality or distorted graphics (this attempt isn't let down by bad grammar, making it more likely some people will take the bait)
• An instruction to click a link to perform an action (hover over them to see where you're really being directed).