0

Late last night I received a "password reset" email from info@mailer.netflix.com.

It looked legit, but I had not requested a password reset. I checked my account's "recent account access" but saw nothing unusual there.

I did not click through and did not reset my password via any other channel. I just left it.

Early this morning I received another email, approx 3 hours after the first

Subject line: - Netflix - Unlock your account -

Email Info:

    from:   Secured Customer <jammzy@hotmail.co.uk>
reply-to:   "info@gov.co.uk" <info@gov.co.uk>

Email contents:

- Encrypted attachment –

This message contains 1 encrypted attachment.

This message can only be opened by <my-email>.

PDF password : 2121

Attached is one file named "Netflix - Unlock -.pdf" which is 112K long.

Is there anything I should be doing about this, apart from ignoring it? (Either for myself, or as a socially responsible "netizen")

2

Late last night I received a "password reset" email from info@mailer.netflix.com.

According to this netflix emails should come from here info@mailer.netflix.com.Please check the SPF and DKIM/DMAC.If it passes then this is official netflix mail.

BUT

from: Secured Customer reply-to:
"info@gov.co.uk" Attached is one file named "Netflix - Unlock -.pdf" which is 112K long.

This email right here is the sketchy one. This MIGHT be a malware.My guess is they used the netflix password reset on your email and when the email went through then try to phish you with a malware.But again i could be wrong BUT it would be best not open that PDF file

Is there anything I should be doing about this, apart from ignoring it? (Either for myself, or as a socially responsible "netizen")

  1. Mark the email as spam so that the system can mark other such emails as spam.
  2. Upload the pdf to virus total if you can.

I wont comment on legal.I have no knowledge of it

| improve this answer | |
  • Marked as correct because (1) External reference to correct Netflix email (2) I didn't know about Virus Total (3) Advice to mark dodgy email as spam. – Stewart Jul 24 '19 at 4:57
  • @vidarlo Did you even read what i wrote?I clearly said the PDF is a malware and the password reset was from netflix.The OP got two emails as he says:one from netflix and then one from someone else – Vipul Nair Jul 24 '19 at 5:48
4

First, this is not an attack via Netflix, is an attack spoofing the email sender. It could be anything: Apple, NASA, whatever. Spoofing an email sender is as easy as writing any name and address on an paper envelope and sending it.

The PDF file is protected so some antivirus software and automated scanners will not be able to detect malware on it.

What you do? Ignore it.

Someone will probably tell you to send it to Netflix, but they have nothing to do with it, and cannot help but tell you this email is not from them.

| improve this answer | |
  • Well, it may look like Netflix is leaking data about if an email is registered there or not, which does have something to do with them. – Matsemann Jul 29 '19 at 11:42
  • The email is coming from Hotmail, not Netflix. And if you target an US email address, you have good chances of hitting a Netflix customer. They are not leaking anything. – ThoriumBR Jul 29 '19 at 12:33
  • 1
    But he got the password reset mail from Netflix first. I just checked. If I enter my own email for a password reset, it says "email sent", but if I type in some random email, I get "no account for this email". So yes, they do leak if a person is customer there and help spammers find valid email addresses. – Matsemann Jul 29 '19 at 12:40
  • You are talking about 2 different scenarios: one is what OP is asking, another is Netflix leaking emails. Almost every service out there does the same, and bug bounties for almost every service says "username leakage is not a vulnerability." In OP case, Netflix does not have anything to do with the email, just got its name used. – ThoriumBR Jul 29 '19 at 18:00
  • He got two emails, the first one is an official password reset from netflix, that came when the attackers veryfied he had an account there. After veryfing, the attackers then sent an email themselves, now knowing he had an account there. That it's not bounty worthy or that everyone does it is irrelevant, they still did leak his email. You can't refute that.. – Matsemann Jul 30 '19 at 5:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.