Phish or Original? (email, screen, Microsoft, work)

[TurcoLoco]

A good test for everyone, especially for novice users to test and educate themselves!

Can you spot the difference?

[MikeJaquish]

Side by side, the phish is not too hard to spot.
But, other than the two **** below, might fool someone handily...

Spoiler

****tennashrook? versus cleverbridge email.
Dear Customer vs. Dear Christian Mairoll
****Somerset County, Pennsylvania telephone exchange https://validnumber.com/phone-number/8142678162/
Details on Payment information and login instructions for new users.

[harry chickpea]

Since the phish stated that the invoice was already paid, no need to even respond at all - just trash. I get fake invoice scams all the time on my junk email. However, the comparison page you linked is a clever marketing tool for getting fearful people to look at the product. That the product costs less than is listed on the phish is a nice subtle value added con that many might miss.

If the page didn't have a bold "Try it for free" at the bottom, I might be more impressed. It is, in effect, just an ad.

[akrausz]

Spotting this type of phish can be tricky even for an experienced user, so I think there is a better lesson to be learned. If Emsisoft got hacked and emails are going to actual Emsisoft customers, then that's one thing. But either way, the simple lesson is never ever provide information in response to any email, pop-up or anything else that shows up on your computer.

My niece's husband tried using the computer and he got scammed. Something popped on the computer, and it caused enough fear that he called the number and ended up paying $175 on his credit card to fix the problem the scammer convinced him existed. He never used the computer again.

[macroy]

My first look is always the email address. In this case, while one of them is not completely shown, it's likely the .xyz domain is the phish (and verified by other clues).

When I do cyber hygiene training - I emphasize on the email address of the sender. Especially in today's world of DMARC, SPF, DKIM etc. Spoofing legitimate domains are less likely - and it's often at the top of the email, so easy to work from.

That said - most of the discussion around my training is more about culture/psychology/sociology vs. technical.

[TurcoLoco]

I commend you all but I have seen all your names around and you are savvy enough for a test such as this.
It really was meant for the novice audience. And yes Harry, it does have an ad at the bottom but that is to be expected, right?

You all caught the signs, no surprise there.

One thing I always tell users is to hover over the hyperlinks WITHOUT clicking on them and take a look at the bottom of the browser or the details pop-up box to see where the actual link is pointing to.
That is usually the biggest giveaway.

One thing I see that is still happening is people see a serious/urgent looking warning on their screen out of the blue that urges them to call Microsoft to resolve an issue with a phone number and they actually call the number, thinking they are actually calling Microsoft (like MS would do that)!
Someone chats them up into installing a remote management app so they can remote on to their machine and start running scripts and do things even manually.

I mean, they are still doing things so blatantly, brazenly and in an old school way.

I looked at machine that were considered hacked or compromised due to a virus. Ultimately, it was the user that was giving the access to the con man willfully, even their account information, etc.

Typically when they collect enough info or gain access, then the demand for money comes, then harassment, etc.

I always try to educate the customers/users because one of the machines I built had everything installed and configured properly and there was no virus, nothing malicious other than some lame batch file that was deleted that the con man used.

Simple Rules for the Novice to follow such as:

1- When encountered an abnormal situation, error, etc. do NOT do anything, immediately contact someone whom you know is savvy and can trust to get help.

2- If anything, without interacting with any windows, simply restart your computer and maybe run a temp file cleaner like CCleaner

3- At the very least, NEVER ever call any number that is presented to you in an email or worse in a pop-up message, click any links in an email, even if it looks legit

For example, even the legit email has "log in at MyEmsiSoft using your...".

I 'd NOT click on any such links even if it is from seemingly trusted, legit sources.

If you have an account with the provider whether it is a software or a Bank, you should already have it in your Favorites/Bookmarks list, use the link there instead.

If you knew me, you probably didn't even bother checking the very link I used in my original post. Thank you for trusting me!
Smart or slightly paranoid ones or those who didn't know me probably did review the link prior to clicking on it using the hover over the hyperlink method aforementioned.

This is very crucial with emails, seeing an email coming from a friend, family member or co-worker with a title like "I Love You" and many of us opened it....

Users will always be the weakest link in any form of security method used.

[MikeJaquish]

Originally Posted by TurcoLoco

...


One thing I see that is still happening is people see a serious/urgent looking warning on their screen out of the blue that urges them to call Microsoft to resolve an issue with a phone number and they actually call the number, thinking they are actually calling Microsoft (like MS would do that)!
Someone chats them up into installing a remote management app so they can remote on to their machine and start running scripts and do things even manually.

I mean, they are still doing things so blatantly, brazenly and in an old school way.
...

Hmmm.... I will start offering to sell the scammers an extended car warranty.

[davebarnes]

Originally Posted by TurcoLoco

Can you spot the difference

As I am not an Emisoft customer, they are both spam to me. Delete.

[Yelling_at_Birds]

Originally Posted by TurcoLoco

I looked at machine that were considered hacked or compromised due to a virus. Ultimately, it was the user that was giving the access to the con man willfully, even their account information, etc.

One of the culprits, I think, is that the way dialogues are worded have conditioned (some) users into the impression that there are real living people on the other end of automated tasks. For example, dialogues that say "Please wait while we check such and such...".
So when a scareware chat appears, it is not so inconceivable, in the minds of these conditioned novice users, that there really is some benevolent team of technicians just looking out for them in real time ...but needs $500 first

The problem is part technical and part social and I wish that software vendors would be less vague in their system dialogue verbiage.

[Peregrine]

Originally Posted by davebarnes

As I am not an Emisoft customer, they are both spam to me. Delete.

Then you would only get one of these.