1

Today I had a malware reunion with a friend which name was used in the From field of a spam.

I don't know if I should warn her about a potential security breach on her computer. Here is the situation. The apparent emitter of the email is a fabricated email address first name . last name @ some boring domain.sg, but the other 19 recipients are people in her contact list. Has she necessary been compromised, either by having her email password stole/guessed or a local malware, OR is there a way that her contact could have been rebuilt another way (maybe using one of those contacts compromised host). How is this usually done ? This eventually leads to some sketchy binary option / trading website, localized for my country. And this also poses as a "Sent from my iPhone" email.

Improve this question
3
  • Is your friend's real email address a yahoo email?
    – TTT
    Mar 15, 2016 at 18:55
  • I believe she still uses only hotmail.
    – alecail
    Mar 15, 2016 at 18:59
  • Somebody with your address in their contact book was owned more then likely
    – Ramhound
    Mar 16, 2016 at 2:07

1 Answer 1

Reset to default
1

The question is, where do all those recipients (and you) appear together? The "compromised" site (where "compromised" may simply mean "publicly readable") is perforce among that list.

But it might be a long list. Its index is itself a list:

  • participants of the same mailing list
  • public pages where the addresses appear together
  • signatories to some Web petition (saw that happen)
  • participants in a forum/newsgroup/other
  • members of the same club

But if the only thing those people have in common is that they're on your friend's contact list - i.e., they don't all also know each other - then yes, the list contains only your friend's account, and chances are that it has been compromised:

  • online (password guessing / social engineering / brute forcing)
  • "offline" (malware downloaded on your friend's PC).
Improve this answer
3
  • I personally know none of the other contacts, and it just looks like random contact from my friend contact list, (contact@SomeDeliveryCompany...) not at all a subset of contacts that could be possibly be found together somewhere.
    – alecail
    Mar 15, 2016 at 19:14
  • Well then, that's pretty good evidence. Your friend's account or PC has either been compromised, or the contacts have been somehow exfiltrated (one possibility is an online backup on a compromised or even malicious server). Account compromise seems the most likely explanation to me, though.
    – LSerni
    Mar 15, 2016 at 19:19
  • It happened to a friend of mine, twice. I received an email from [email protected] sent to me and other recipients. Some of the other addresses were also used for Facebook profiles, but other weren't. And since we didn't join any kind of online(or offline) club, the most plausible explaination is malware.
    – A. Darwin
    Mar 18, 2016 at 10:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .