Received 2 "Delivery Status Notification (Failure)" Mails from [email protected] with messages I did not send. Is this an attack?

Question

about 1-2 hours ago, I received 2 emails from [email protected] on my personal email with title "Delivery Status Notification (Failure)" and a body as such:

This is an automatically generated Delivery Status Notification.

Delivery to the following recipients failed.

   (email I never heard of)

The emails have 2 attachments: details.txt containing the following content:

Reporting-MTA: dns;SNT004-IMC1S8.hotmail.com Received-From-MTA: dns;SNT004-MC5F5.hotmail.com Arrival-Date: Fri, 2 Jun 2017 11:03:56 -0700

Final-Recipient: rfc822;(email I've never heard of) Action: failed Status: 5.5.0 Diagnostic-Code: smtp;550 Requested action not taken: mailbox unavailable (-506263085:397:0)

and an Outlook item called "You've Got Postcard" with login credentials for My Postcard.

Is this a known scam or malware attack? I use Outlook, and unfortunately it showed both emails in a preview window, which from what I understand is equally bad as directly opening the email with regards to potential for infection.

---

Update: the website that the "You've got Postcard" mail links to is wintergate dot com slash controlsk dot php (escaped to avoid accidental visits). One of the credentials (in case it helps) is kkrasa, Domain msn, Top Level Domain com (escaped to avoid spam) with password "BIZ" + "K7", so both quoted terms concatenated in this order without double quotes.

If anyone is interested in the direct HTML of the Postcard mail, it can be found at https://pastebin.com/twSL5v4a. I have already deleted the original email, so I cannot provide anything beyond this (this was in my Notepad++ cache).

Answer 1

Its a very common type of phishing. Most likely they have spoof your address as the sender (From: ) and might intentionally cause a bounce so you would get/open the emails.

You are correct in that it is as bad. This is specially true if the email is html encoded and it could be executing something malicious and you wouldn't even know it.

Your are always much safer in running outlook in plain text mode only and probably only load html emails from trusted sources. Your other option is since your using windows (most likely) cause its outlook, you could have your antivirus scan your emails to be safer.

Again though I would opt out to view emails in plain text just to be safe.

Answer 2

It's most likely plain phishing, potentially with an embedded beacon if the message contained HTML. Any images downloaded when viewing the message can be used by a spammer/scammer to verify they have sent mail to a working address. As takumi said, use plain text if it's available in your MTA, and disable previews and image loading.

You need to examine the mail headers to determine whether the message really originates from servers authorized to send on behalf of the address in your MTA's visible 'From' field. In cases like this (DSN, bounce notification, etc), I look at the chain of relays in the headers to make sure that the 'postmaster' really is the postmaster at the domain the message claims to be from. Microsoft signs messages with DKIM headers; these can also be used to determine validity. Your mail server (or that of your provider) should check this and use it as part of a spam checking process, but many don't. Post the headers if you'd like help reading them. Be aware of the implications -- if you don't want an 'attacker' knowing your address is yours and you read your email, don't post it here :)

If you are using OWA, it's possible that the preview message contents (and any remote images or other attachments) could have been retrieved by the webmail servers and relayed to you, at least preventing your IP from being revealed to the sender.