1

Today I had a malware reunion with a friend which name was used in the From field of a spam.

I don't know if I should warn her about a potential security breach on her computer. Here is the situation. The apparent emitter of the email is a fabricated email address first name . last name @ some boring domain.sg, but the other 19 recipients are people in her contact list. Has she necessary been compromised, either by having her email password stole/guessed or a local malware, OR is there a way that her contact could have been rebuilt another way (maybe using one of those contacts compromised host). How is this usually done ? This eventually leads to some sketchy binary option / trading website, localized for my country. And this also poses as a "Sent from my iPhone" email.

  • Is your friend's real email address a yahoo email? – TTT Mar 15 '16 at 18:55
  • I believe she still uses only hotmail. – alecail Mar 15 '16 at 18:59
  • Somebody with your address in their contact book was owned more then likely – Ramhound Mar 16 '16 at 2:07
1

The question is, where do all those recipients (and you) appear together? The "compromised" site (where "compromised" may simply mean "publicly readable") is perforce among that list.

But it might be a long list. Its index is itself a list:

  • participants of the same mailing list
  • public pages where the addresses appear together
  • signatories to some Web petition (saw that happen)
  • participants in a forum/newsgroup/other
  • members of the same club

But if the only thing those people have in common is that they're on your friend's contact list - i.e., they don't all also know each other - then yes, the list contains only your friend's account, and chances are that it has been compromised:

  • online (password guessing / social engineering / brute forcing)
  • "offline" (malware downloaded on your friend's PC).
  • I personally know none of the other contacts, and it just looks like random contact from my friend contact list, (contact@SomeDeliveryCompany...) not at all a subset of contacts that could be possibly be found together somewhere. – alecail Mar 15 '16 at 19:14
  • Well then, that's pretty good evidence. Your friend's account or PC has either been compromised, or the contacts have been somehow exfiltrated (one possibility is an online backup on a compromised or even malicious server). Account compromise seems the most likely explanation to me, though. – LSerni Mar 15 '16 at 19:19
  • It happened to a friend of mine, twice. I received an email from firstname.lastname@anotherdomain.com sent to me and other recipients. Some of the other addresses were also used for Facebook profiles, but other weren't. And since we didn't join any kind of online(or offline) club, the most plausible explaination is malware. – A. Darwin Mar 18 '16 at 10:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.