Revise Invoice
These days, I'm receiving requests about invoices. People want to pay me but my invoice has a problem/concern.
The fact is that the invoice is a PDF document with a link to a hacker's website where you'll be asked to enter various credential. Their code may also attempt various XSS attacks or similar things.
If you get those, opening the PDF is most probably safe, but following the link is not.
Return-Path: <SRS0+0UFE=5L=hotmail.com=Jonie_Whishaw@m2osw.com> X-Original-To: alexis@m2osw.com Delivered-To: alexis@m2osw.com Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-oln040092000077.outbound. protection.outlook.com [40.92.0.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by m2osw.com (Postfix) with ESMTPS id CC0DE419DC for <alexis@m2osw.com>; Tue, 6 Jun 2017 23:54:02 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.1 m2osw.com CC0DE419DC Authentication-Results: mail.m2osw.com; dmarc=none header.from=hotmail.com Authentication-Results: m2osw.com; dkim=pass (2048-bit key; unprotected) header.d=hotmail.com header.i=@hotmail.com header.b=q7VW6Wzt; dkim-atps=neutral DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=sVAHACq+byC5UOWBU4suvTcxWO9FJ9btOkvoYnKKYAY=; b=q7VW6WztmplhzalfPABUQG+arUHS95dThNZ4G8JPxMu36AMsQFdHIPcPR8GD4n/UyiaXIZLJ2xU4Ox5+MxdnarIMXkvPqLcPFI +1nYF0yX3KkPePa/HV6ZwwBRQPSpR5iFQEIZDSe5BzI7mCC3No4fx1X38ebEquPkwX04pqLNNF/gEaEz0rygKh4OvHP+jQ+Mo6qK x4J4hOUhENbsqoFSLMc7ip8xoaX+OF1pqGpGhZcCv4rGk1Y4K/TUcRK5VI92aKZ5UkVdK0SkUpYmLb+5OC9bc8YsGPoyFytN11Fg z0gmIQgBQLsl3sYrv1Y1wwgnyiyh4HbsDVTZng6RwQ7Q== Received: from BN3NAM01FT020.eop-nam01.prod.protection.outlook.com (10.152.66.54) by BN3NAM01HT144.eop-nam01.prod.protection.outlook.com (10.152.66.134) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1101.12; Tue, 6 Jun 2017 23:54:01 +0000 Received: from DM3PR15MB0799.namprd15.prod.outlook.com (10.152.66.51) by BN3NAM01FT020.mail.protection.outlook.com (10.152.67.227) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1143.11 via Frontend Transport; Tue, 6 Jun 2017 23:54:01 +0000 Received: from DM3PR15MB0799.namprd15.prod.outlook.com ([10.164.201.15]) by DM3PR15MB0799.namprd15.prod.outlook.com ([10.164.201.15]) with mapi id 15.01.1143.019; Tue, 6 Jun 2017 23:54:01 +0000 From: FirstName LastName <Jonie_Whishaw@hotmail.com> To: "alexis@m2osw.com" <alexis@m2osw.com> Subject: Fwd: Revise Invoice Thread-Topic: Revise Invoice Thread-Index: AQHS3yArcSd3wLu6Z0OTY8EKy9ozBQ== Date: Tue, 6 Jun 2017 23:54:01 +0000 Message-ID: <DM3PR15MB0799517F5B13C886BFA07B2F8CCB0@DM3PR15MB0799.namprd15.prod.outlook.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: m2osw.com; dkim=none (message not signed) header.d=none;m2osw.com; dmarc=none action=none header.from=hotmail.com; x-incomingtopheadermarker: OriginalChecksum:57327801DA7DB8F2B7D966415B6B6DCB6307F22C0FA327DED6530 8EBAF9F6DFD;UpperCasedChecksum:DA74FBDFA4CB8BE84B79FCED3DA624A35EFDB8E86419DA5A5D4BEFB79BDC8176; SizeAsReceived:7006;Count:43 x-ms-exchange-messagesentrepresentingtype: 1 x-tmn: [UQMsPl7vE3oG0E/XEccxGFrmpLIsIENd] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1;BN3NAM01HT144;24:GjnJ5fAYf+QzMI1R0ATJL03eBDJFxfDdL+IET9WL+pp8 lySZwEy/T7CmqbiZ0piMMH8Ms7w09Jm0PeHs+WcUSAcanRoyZUuzuLjHxM/M6Qc=;7:iWeI4gIE7aTVpgvCH1rnZRLFeiO oqKhTNwPv6AdHGAg+vF92QUeqMyShf67Qg2joJRTLTx4F6EpaV58NYkDO9chO70afr43QG5s6y1viuvoN/TNwcg+u02RZe SkCu24fqCtPfACDnJKkXb4NhdmfdnQaFqiJpT0pw+NbcQzk7UlwT0n7zy0D1U4DSQliI4lW72NALieRTRVVTKRsXSX/eOo PEkjepPF+rdrVp+QmLPpjwu6vOyAMNBvYA6Tn6VGi26j/fEjU35RdV3EJE+zy5PAa+r5ngzt4t0zWbpBjUBaVlD7YTuBMa TDeaowKkhtx x-incomingheadercount: 43 x-eopattributedmessage: 0 x-forefront-antispam-report: EFV:NLI;SFV:NSPM;SFS:(7070007)(98901004);DIR:OUT;SFP:1901;SCL:1;SRVR: BN3NAM01HT144;H:DM3PR15MB0799.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en; x-ms-traffictypediagnostic: BN3NAM01HT144: x-ms-office365-filtering-correlation-id: 0e6f1059-33bb-42cb-01d6-08d4ad374cd6 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(201702061074)(5061506573)(5061507331) (1603103135)(2017031320274)(2017031324274)(2017031323274)(2017031322274)(1603101448) (1601125374)(1701031045);SRVR:BN3NAM01HT144; x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101) (100105300095)(100000702101)(100105100095)(444000031);SRVR:BN3NAM01HT144;BCL:0;PCL:0;RULEID: (100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101) (100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:BN3NAM01HT144; x-forefront-prvs: 033054F29A spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/mixed; boundary="_004_DM3PR15MB0799517F5B13C886BFA07B2F8CCB0DM3PR15MB0799namp_" MIME-Version: 1.0 X-OriginatorOrg: hotmail.com X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Jun 2017 23:54:01.0139 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Internet X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3NAM01HT144
Dear alexis@m2osw.com, We are ready to make the payment but seriously confused about the genuine bank details.I called your office number, but no response.Kindly Check why the two Invoice you send to us has different Bank details because we receive another bank details yesterday instructing us that this is your new bank info. We dont want any delay from our side that is why we are concern, kindly put us through in a revised invoice. Your soonest reply will be appreciated Thanks and best Regards, Captain Rogerlee.
(attachment is a PDF that looks like this, the View On Adobe button is a link that will ask you credential you don't want to give those guys!)