1

I was looking through my unread emails when I accidently opened a Paypal phishing one. I thought it was legit because I saw in the preview it was from "[email protected]", but I got some doubt after noticing the email was full of grammar mistakes and was using shorted links. Looked at some legit Paypal emails I received and those were from "servi[email protected]". So, I definitively opened a phishing email.

I'm really paranoïd about computer security. I usually use virtual machines to surf the web and open such emails on my daily driver OS, but that time I made the mistake and opened that email directly on.

I know that phishing goals aren't usually to infect computers with malware, but now I feel a bit insecure since I usually don't open emails from unknown senders.

I did a drive image, redeployed it on another computer then run MalwareBytes, SpyBot Search & Destroy as well as a McAfee Antivirus scan. Nothing suspicious was found. Drive image was to avoid installing all those antivirus softwares on my daily driver OS since they usually leave some unwanted files or registry entries after uninstalling.

I grabbed a copy of the phishing email (.eml) to inspect it, there was some links like "paypal=objects.com/digitalassets...", few "t.co" shortened URLs (which would actually redirect to the phishing site) and some links from MailChimp, such as "gallery.mailchimp.com/...". Opened the "t.co" links in a virtual machine, currently broken. Note that the email was been in my mailbox since this January, so links were probably flagged way before I opened that email. Some screenshots of that phishing email are in attachment to that question.

Automatic picture download as well as email preview were turned on. I'm using Windows 10 Mail App.

Considering all of this, should I format my hard drive then completely reinstall my daily driver Windows to be sure I'm safe from malware which could come from opening that email (without clicking links on) ? Or that doesn't worth it ?email content

My configuration is : Windows 10 (with all updates), Windows 10 Mail App, Windows Defender

Improve this question

1 Answer 1

Reset to default
2

You are most likely safe. As you said, the objective of those phishing emails is to trick you into believing their website/email is legit so you interact with them and give them your data. The chances of them injecting malware on your computer that can run without being executed and not being picked up by all those AV solutions that you used are minimal.

That being said, the real problem here is your options. You can not claim to care and worry about computer security and have your email auto load remote content. You should turn it off immediately. Most email attacks, other than phishing, rely on 3 things that you are absolutely under control.

  • Do not download files that you are not certain about.
  • Do not auto load remote content.
  • Do not display emails as original html. Go with either plain text or simple html at least.
Improve this answer
2
  • Alright, I turned off "Automatically download external images and style formats", but I couldn't find the option to receive emails in plain text or simple html on the Windows Mail app. Also, is gallery.mailchimp.com a malicious website ? I couldn't investigate what it was downloading from that phishing email (see screenshots).
    – pmbonneau
    May 27, 2018 at 15:48
  • @pmbonneau Here is how you can enable to view emails as plain text on outlook. The site mailchimp by itself is safe, they are a legit marketing business, but can't control what is hosted there. It seems they were simply loading images from there to obfuscate the links they wanted you to click on. The t.co are shortened twitter links to try and deceive you and your email operator that the email is safe, so they are not aware of the real website they are trying to redirect you to.
    – Podesta
    May 29, 2018 at 12:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .