New Wave of Phishing Emails

[Lauda]

It looks like someone is using the forums hacked database again for nefarious purposes. Several individuals have mentioned receiving these emails, and at least some have already fallen victim to them.


Do not download.

[1713549409]

1713549409

[1713549409]

1713549409

[1713549409]

1713549409

[Zepher]

Email came from brianbooker@uk2.net

As Lauda says, do not open any attachments. This is ransomware or malware.

[goinmerry]

Anyone have an idea how it is possible to acquired information to us? Kinda want some technical knowledge about this kind of phishing attempt*.

As I mentioned in related thread to this, I used my unused extra old laptop (the stock one) to find out what will happened out of my curiousity. Connect it to internet, download, remove internet and open it. My security there are not triggered. Im wondering how it can access those inside stuffs?

[Lauda]

Anyone have an idea how it is possible to acquired information to us?

The forum was hacked in 2015. I assume the database used for this phishing attempt is from that hack.

Kinda want some technical knowledge about this kind of phishing attempt*.

Use Google then?

As I mentioned in related thread to this, I used my unused extra old laptop (the stock one) to find out what will happened out of my curiousity. Connect it to internet, download, remove internet and open it. My security there are not triggered. Im wondering how it can access those inside stuffs?

You won't really figure out what it is doing or attempting to do without adequate technical knowledge, unless it is plainly obvious (e.g. ransomware screen).

[Quickseller]

The btc-e DB has been hacked multiple times. I suspect the emails came from one of these hacks.

[Lauda]

The btc-e DB has been hacked multiple times. I suspect the emails came from one of these hacks.

I have not registered on BTC-e with this username, nor this email. Therefore, it had to be from Bitcointalk considering that other BTCT users have been getting them as well.

[LeGaulois]

Got it as well and as Lauda the email used the username that i use only here. So it comes from the previous hack
the domain used to send the email is globo.com

[helloeverybody]

I can confirm i also got this email today as well and theres no other places ive used that email so its definitely from the hacked database.

[owlcatz]

I can confirm i also got this email today as well and theres no other places ive used that email so its definitely from the hacked database.

There is a new wave of phishing scams in the past 24 hours - a few users have already been burnt over .3 btc -



Then the url looks just like bitcointalk and wants you to login... so this is new, ongoing - not good!!! I reported one yesterday as well and gave it red trust -

https://bitcointalk.org/index.php?action=profile;u=986625

Thanks, and be careful out there - bitcointalk.org links will be green not blue!!!  

EDit - https://bitcointalk.org/index.php?topic=1898264.msg18840021#msg18840021

[zekoroger]

be careful, that phishing fucker scammer make me alot damage today

[owlcatz]

be careful, that phishing fucker scammer make me alot damage today

Fixed link for ya... 

[Joel_Jantsen]

I can sort of establish a connection.The attacker is probably sending mails to coin collectors who are assumed to be having more bitcoins on them ? Lauda and Zepher is merely a case but it does connect the dots.

[erikalui]

I thought that I got this mail as a payment of one of the campaigns I have participated. I downloaded the attachment as well but since I don't have btc-e account, is it something I can do to now? I deleted the word doc file from my computer but my antivirus did not give me any alert.

This was the email I received: http://prntscr.com/f3cucm

[Zepher]

I thought that I got this mail as a payment of one of the campaigns I have participated. I downloaded the attachment as well but since I don't have btc-e account, is it something I can do to now? I deleted the word doc file from my computer but my antivirus did not give me any alert.

This was the email I received: http://prntscr.com/f3cucm

If you used the password to unlock the attachment, consider your PC infected.

Keyloggers/coin stealers/and a bunch of other stuff could be running in the background.

Wipe your PC.

Start off with a fresh operating system.

[Coin-Keeper]

Haven't seen one of these yet.  Stuff like this is why I use Linux virtual machines for all my workspace!  Snapshots are your friend.

[anonymoustroll420]

It's most likely the old Bitcointalk database

[HeroC]

I got this email too, encrypted docx that wanted editing privileges from some random email @mail.com

[chronicsky]

and stupidly, my friend clicked download on the file.
Fortunately i noticed in time before he put the password in it.

is it gonna do anything if it has been downloaded?
I deleted it instantly :/

[pooya87]

This may be a good reminder:

Real link is green when you move your mouse over: bitcointalk forum (real link)

Fake link is not: bitcointalk forum (with different/fake link)

p.s. i am referring to the attempt that owlcatz mentioned not the email (obviously )

[Gimpeline]

I got the mail too.
I dont have an BTC-e account or use this e-mail in other places so it must come from here