subcard@uk-ie.subwaysubcard.eu Scam Email - Order Being Processed

If you have received an email like the one below that appears to have been sent from subcard@uk-ie.subwaysubcard.eu, which claims your order documents are ready and awaiting confirmation, please do not click the link in it. This is because the link in the fake email goes to a malicious website that asks visitors to download a malicious Microsoft Office Excel document that will infect their computers with viruses and other malware.

subcard uk-ie.subwaysubcard.eu Scam Email - Order Being Processed

The subcard@uk-ie.subwaysubcard.eu Scam Email

The subcard@uk-ie.subwaysubcard.eu Scam Email

The malicious Microsoft Office Excel document contains a password to prevent anti-virus software and anti-malware from detecting the Macro virus or malware in it. But, the malicious document cannot do anything unless the person who downloaded it "Enable Editing" and "Enable Content" from the yellow bar. This is is why it is important that online users never open password-protected Microsoft Office documents, "Enable Editing" and "Enable Content".

The Malicious Microsoft Office Excel Document

subcard@uk-ie.subwaysubcard.eu Malicious Office Excel Document

Online users who have already opened the malicious document, "Enable Editing" and "Enable Content" are asked to scan their computers with the antivirus software installed on them to remove malware that may have been installed by the malicious Office Excel document.

Check the comment section below for additional information, share what you know, or ask a question about this article by leaving a comment below. And, to quickly find answers to your questions, use our search Search engine.

Note: Some of the information in samples on this website may have been impersonated or spoofed.
Was this article helpful?  +
Share this with others:

Comments, Questions, Answers, or Reviews

Comments (Total: 4)

To protect your privacy, please do not post or remove sensitive information in or from your comments, questions, or reviews. NB: We will use your IP address to display your approximate location to other users when you make a post. That location is not enough to find you.

Your comment, answer, or review will be set as anonymous because you are not signed in. An anonymous comment, answer, or review cannot be edited or deleted, therefore, review it carefully before posting. Sign-in.

The comments, reviews or answers below do not necessarily reflect the views of Online Threat Alerts (OTA).

  • December 11, 2020 at 1:15 PM by an anonymous user from: North Lincolnshire, Brigg, England, United Kingdom

    Had two emails and both come from the same source as previous legit subway emails

    SPAM EMAIL:

    ARC-Authentication-Results: i=1; mx.google.com;

    dkim=pass header.i=@UK-IE.subwaysubcard.eu header.s=cm header.b=K5SqJtWC;

    dkim=pass header.i=@cmail2.com header.s=cs2013 header.b="E/oeDTFJ";

    spf=pass (google.com: domain of subcard-mtllhz1jhtriuhkdd1i@cmail20.com designates 203.55.21.201 as permitted sender) smtp.mailfrom=Subcard-mtllhz1jhtriuhkdd1i@cmail20.com

    Return-Path: <Subcard-mtllhz1jhtriuhkdd1i@cmail20.com>

    Received: from mx201.a.outbound.createsend.com (mx201.a.outbound.createsend.com. [203.55.21.201])

    LEGIT EMAIL:

    ARC-Authentication-Results: i=1; mx.google.com;

    dkim=pass header.i=@UK-IE.subwaysubcard.eu header.s=cm header.b=vMcqLGAI;

    dkim=pass header.i=@cmail2.com header.s=cs2013 header.b=KPjU9QAw;

    spf=pass (google.com: domain of subcard-mjhjyik1jktjdhutht1i@cmail20.com designates 27.126.146.33 as permitted sender) smtp.mailfrom=Subcard-mjhjyik1jktjdhutht1i@cmail20.com

    Return-Path: <Subcard-mjhjyik1jktjdhutht1i@cmail20.com>

    Received: from mx33.b.outbound.createsend.com (mx33.b.outbound.createsend.com. [27.126.146.33])

    subway systems or their mailing software partner have been breached

    • December 11, 2020 at 1:53 PM by info

      It is seems as if they are using a email newsletter software called CreateSend at thormailer.com

  • December 11, 2020 at 12:08 PM by an anonymous user from: E1, London, England, United Kingdom

    Just had the same email and blocked it.

  • December 11, 2020 at 8:46 AM by an anonymous user from: York, England, United Kingdom

    I've had one today saying "Thank you for shopping with us, you'll find a summary of your order below" with a link. Luckily I did not click it as I knew I hadn't ordered anything.

Comments Show More Comments (3)

Write Your Comment, Question, Answer, or Review

subcard@uk-ie.subwaysubcard.eu Scam Email - Order Being Processed