2

Two days ago, I received an email saying as object "March rent" in French. It says time to pay my rent for the month of March, and got the email March 1st... I thought this was my landlord sending me an email, as he sometimes do. However, there was no much info in the mail except a word document attachment .docx, that I opened to see what it was about. Found out this is a scam trying to makes me transfert money. Deleted.

The issue, I opened the attachment, and worst, I don't know what can happen.

I'm using an iPhone 7 on latest iOS, the attachment has been opened with the default Mail app.

Uploaded the file on Virustotal, nothing found.

Uploaded the file on Hybrid-Analysis (sandbox run), nothing malicious seems to have been done.

Renamed .docx to .zip, extracted and inspected the content. Only found .xml stuff, nothing relevant here. Looks like the document contains no macros.

I'm still worried that something might have infected my device with that attachment, what can I do to get peace of mind ?

0

3 Answers 3

1

Colloquially, the terms "phishing", "scam" (including BEC), and "malware" are used interchangeably, something that makes it really difficult to discuss them as separate concepts. I prefer to think of them as mutually exclusive categories:

Phishing attacks aim to harvest your credentials, such as by tricking you into plugging them into a form. The threat you're asking about looks more like a scam (like Business Email Compromise or just standard advance-fee fraud), which is a conversational attack (they talk you into giving them your money or access). These rarely overlap with malware, which will mess with your computer.

I see you've already determined that the .docx does not contain a macro. Nearly all attacks in that file format require a macro, so that's a good sign. If there was a macro, the next step would be to determine if your phone's software would even run a macro. A lot of systems will refuse to run macros or will at least warn you before trying.

If you're a high-value target (privileged access worth vast sums of money or of other high consequence; e.g. you're an elected official, a CFO, or admin with broad access), it would be wise to be thorough and wipe everything after your information security team performs a detailed analysis.

Otherwise, because there were no macros, your software and OS were fully up to date, and you didn't find any hits on VirusTotal or in a sandbox (though this was a Windows sandbox, not an iOS sandbox), you're probably fine.

1

Should you worry? Not really.

This sounds like a social attack targeting the human holding the phone (trick you into transfering money) and not a technical attack targeting the phone itself (install malware).

Besides, you verified that the filed does not contain macros. In fact, .docx files can not contain macros. I would be suprised if Word on iOS even runs macros.

There is never a zero procent risk, but if you want to spend time and energy on improving your security it is probably better spent elsewhere.

-1

Factory reset if you could afford, but might be too extreme.

Check for network connections that look suspicious, like IP addresses that are creating sockets. Verify all IPs are not malicious.

Scan attachment for IP addresses that could be CNC

Install a free antivirus and do a scan.

Also, any cloud services connected, check logs their too for any suspicious sign-ins.

With all that said, if you are running the last iOS, you are probably safe.

Just a couple ideas.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .