Don't open that 'copyright infringement' email attachment – it's an infostealer Organizations should be on the lookout for bogus copyright infringement emails as they might be the latest ploy by cybercriminals to steal their data. The most recent version of the Rhadamanthys infostealer malware is being spread far and wide, targeting organizations across multiple continents, as part of an ongoing phishing …
I thought for a second that even a complete numbskull would notice a .EXE and a .DLL in their .ZIP, and think it just a little bit phishy, but then I remembered that WINDOWS HIDES FILE EXTENSIONS BY DEFAULT.
Stop doing that, borkzilla, and you would save a few numbskulls paying customers..
Quite easily spoofed? Trivially, because if the extension is .EXE then Windows happily reads the icon from the .EXE file itself..
But that would be fine, so long as it was obvious that the file is an executable presenting with an "Adobe Acrobat" icon, rather than a PDF file.
I wonder if packaging in a ZIP also gets around the "This file was downloaded from the internet, are you sure that you want to open / run it" flag (as well as bypassing any email antivirus filters, as they can't see inside the encrypted zip, even when the trivial password is provided in the email)
MS expects (and gets it) increased dependency on its Security Suite, by keeping poor security at the OS and Domain level.
The reality is nearly 40 years after its creation, MS OSs are still DOS and CSVs at the core, and still it's greatest weakness.
Innovation has been replaced by making products more complex and painful to use, built on the same weak base structure.
Once upon a time The Register would say which OS or OSs were affected by such attacks. The mention of a dll indicates this attack is performed on the Microsoft Windows OS. There is no mention of Microsoft or Windows in the article at all, or that MacOS, Linux, BSD, etc., etc. users are safe from this particular attack. Is this lack of mention of the attacked system due to us commentards knowing that when we see dll we know it's a Windows problem? Or perhaps there's some force in the background that has editorial control of articles published in these hallowed pages? Maybe it's to do with search results? Has the Vulture had its beak taped up so it can no longer bite the hand that feeds IT - particularly if the IT getting bit is from Microsoft? Should we be told? :-)
Anything that is serious such as notice of a copyright infringement shouldn't be coming through a gmail account. Certainly not a notice from an attorney.
When a client hands me a gmail address, they don't get the same level of service as I've learned from experience that those people are the least likely to be around for the long term. Somebody with their own domain and even the most simplistic web site gets a lot more cred. I know that my website doesn't bring in very many clients, but it does act as a flyer that shows the services I provide and samples of my work. If I handed out the same thing on paper, it would get thrown away as nobody is filing tangible handouts, catalogs, etc. I used to have a couple of cabinets of catalogs and cut sheets and have long since turned that into bookmarks, a database and spreadsheets.
Flag number one is always an email address from a free service. This would be especially so for a copyright infringement notice. If the entity couldn't be bothered to have a proper business backend, I can ignore them as it's very unlikely they'll take the matter any further. If they do, I expect I'd be getting notice from a verifiable attorney.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
