Canon@ Malicious Email Messages with Virus Attached
Online users, do not open unexpected attachments in email messages that appear to have been sent from email addresses starting with "canon@". Especially, email attachments with filenames ending with ".zip", ".docm", or ".xlsm". Cybercriminals infect their potential victims’ computers with malware by placing a virus, ransomware, spyware or Trojan horse in ".zip" files, attach the same files to email messages, and send them to their potential victims.
Samples of Malicious Canon@ Emails
From: canon@onlinethreatalerts.com
Subject: Attached document
Attachment: Attachment: 1919_003.docm
Date: Wed 14/12/2016 11:42Message
Attachments1Download All Attachments
Download All Attachments [Attached document].zip
1919_003.docm
From: canon@onlinethreatalerts.com
Subject: Attached image
Attachment: Attachment: 1919_003.docm
Date: Wed 14/12/2016 11:42Message
Attachments1Download All Attachments
Download All Attachments [Attached document].zip
1919_003.docm
Files ending with “.docm” or “.xlsm” are Microsoft Word and Excel documents that contain Macros. Macros are a set of instructions that are used in Microsoft Office to automate simple and complex tasks to make things easy for Microsoft Officer users. But, Macros can also be used to do dangerous things like downloading and infecting computers using Microsoft Office with malware. Therefore, online users should never enable Macros when they are prompt to enable Macro or Content for untrustworthy or unexpected Microsoft Office documents.
Another file used by cybercriminals to infect their potential victims’ computers with malware is a “zip” file or a file with name ending with ". zip" . Zip files are used by cybercriminals because they may bypass email providers’ antivirus software, which are used to scan and remove malicious email attachments. Therefore, online users are asked not to open unexpected "zip" email attachments and should ensure that they have antivirus software on their computers.
Check the comment section for additional information, or share what you know or ask a question about this article, by clicking the 'View or Write Comment' button below.
Note: Some of the information in samples on this website may have been impersonated or spoofed.