I got a pretty lame try to of phising mail, what did they try to do?

Question

I just got one of the typical mails that tried to get my interest by bombing me with stuff they know about me, like: They know I like to get money and even know what my first name is.... Or did they even fail to do that?

Well the first line simply was:

Dear %%$FirstName%%,

So it looks to me they tried to insert something by a placeholder probably expecting to be inserted by a database or so.

First I thought maybe it is just because it is blocked by being marked as spam, So first I was pretty excited about how they would inject some malicious stuff tricking the security of my mail provider. So I created a sandbox where I told the provider to "load anyway all external contents".

But the first line remained in plaintext:

Dear %%$FirstName%%,

Well I was a bit confused in the first seconds as I really had no clue how this placing into an email body would lead to anything.

So how might they expected this to work? A placeholder being part of the emails text that somehow gets replaced after being on the servers of my provider. Did they hope the provider might parse my mails and insert for this place holder my $FirstName ?

Or were these guy just somehow pretty stupid?

Answer 1

They obviously use a template for those emails and either encountered a bug in their system or the template engine didn't substitute the information since they didn't have it.

In any case, this is not something that would get filled on your computer or at your email provider.

In the future, you should refrain from opening that crap as it is most common for the spammers to use tracking techniques (such as pixel images or similar) to know if the message was opened. When they notice it was, that confirms that it is a good address to send more spam and phishing attempts.