Scam emails using peoples personal details from PayPal

[Badooleoo]

UPDATE: Seems everyone is getting this scam email, We have pretty much confirmed this has been caused via PayPal accounts.

Check your email used with PayPal to see if you received this email using your full name as stated in your PayPal account.

If you wear a tin foil hat you might want to change your password.
If you like to winge you can send an email to PayPal at https://www.paypal.com/au/cgi-bin/he...ontact-general (login required)

---

I just received a bogus email from "Adobe Incorporated" about adobe acrobat reader having a new version.

Now besides the email being put in the spam can and really doesn't concern me the scary thing is it was addressed using my real first and last name and sent to my personal email address.

I don't use my real name anywhere online and just about anywhere possible in the real world.

Be careful, damn marketing lists, NOT HAPPY! I'm pointing the finger at PayPal, its the only place that has my name and use this email address. there's no way to change your name there either.

from:    Adobe Incorporated <news@newman.cccampaigns.net>
reply-to:    Adobe Incorporated <news@adobe-new-downloads.com>
to:    (me at a personal email address)
date:    28 February 2011 12:29
subject:    Adobe Acrobat Reader latest version released ! Upgrade Available Now

Dear [FIRST NAME] [LAST NAME],

Adobe is pleased to announce that a new version of Acrobat PDF Reader was released today with new features, options and improvements.

http://www.adobe-new-downloads.com

What's new in this version :

* Read, search, and share PDF files.
* Convert to PDF.
* Export and edit PDF files
* Add rich media to PDF files
* Combine files from multiple applications
* Increase productivity and process consistency
* Streamline document reviews
* Collect data with fillable PDF forms
* Protect PDF files and content
* Comply with PDF and accessibility standards

To get more and upgrade to this version, go to  :

http://www.adobe-new-downloads.com

Start downloading the update right now and let us know what you think about it.

We're working on making Adobe Acrobat Reader better all the time !

Talk soon,

The people at Adobe       

Copyright © 2011 Adobe Systems Incorporated. All rights reserved.

These are what some of the websites look like:



UPDATE: Anonymous baste.bin text, beware these domains

adobe-pdf-upgrades.com
skype-instant-download.com
skype-instant-update.com
2011-skype-center.com
2011-skype-center.net
2011-skype-center.org
acrobat-reader-downloads.org
adobe-acrobat-2011-upgrade.com
adobe-acrobat-upgrades.org
adobe-new-updates.com
adobe-new-upgrades.com
adobe-pdf-2011-upgrade.com
adobe-reader-upgrades.info
microsoft-licensing-center.com
official-skype-updates.com
skype-2011-downloads.com
skype-2011-downloads.net
skype-2011-downloads.org
skype-instant-upgrade.com
skype-instant-upgrades.com
adobe-new-downloads.com

- Also new 1st March 2011
http://www.official-adobe-software.org

UPDATE: seems some domains are not working now, also javascript on these sites is being run from secureonline.ru, secureonline.com from what ive seen of the working ones.

Other sites informing of this scam:

• http://www.awesomedude.com/adboard/i...showtopic=5575
• http://www.computersecurityarticles....ons-for-skype/ (read the latest comments in this one, eg The Blake, 1st March)
• http://blog.mxlab.eu/2010/09/14/mali...ons-for-skype/
• http://stopmalvertising.com/spam-sca...all-pages.html
• http://37prime.wordpress.com/2011/02...t-reader-2011/
• http://www.freak-search.com/en/threa...ls_from_paypal

[kwhohasamullet]

Pretty sure you will find that email is actually a phishing email... i think the domain www.adobe-new-downloads.com is a bit of a give away

[Badooleoo]

Yes but somehow my real name has been acquired.

[glasnt]

Originally Posted by Badooleoo

Yes but somehow my real name has been acquired.

They could have gotten it from anywhere you use your real name. It happens.

Just don't download Adobe Reader from that link <_<

[Crashoveride]

i got the same email today, except the link was to adobe-software-upgrades_dot_com

Dodgy as

[Badooleoo]

Originally Posted by glasnt

They could have gotten it from anywhere you use your real name.

I think you missed the bit I said about I don't use my real name anywhere.

[Jobe]

CONSPIRACY! been getting it for ages in my spam folder. link was a dead giveaway. Sad that you wouldn't have picked up on it being a scam if it weren't for using your name. You need to go back to your learner internet licence.

[qwertylesh]

please remove the URLS from your OP as theyre most likely malicious or would lead to something malicious.

I had these too btw.
I just add a rule if they get past the filter 'if in title' *skype* *2011* *adobe*
since its all bullshit, i just have it auto move to trash.

[Jobe]

Originally Posted by qwertylesh

please remove the URLS from your OP as theyre most likely malicious or would lead to something malicious.

I had these too btw.
I just add a rule if they get past the filter *skype* *2011* *adobe*
since its all bullshit, i just have it auto move to trash.

and? this is supposedly a tech enthusiast forum.

www.click2downloadAvirus.ru

*whistles*

[Tinian]

Originally Posted by qwertylesh

please remove the URLS from your OP as theyre most likely malicious or would lead to something malicious.

I had these too btw.

I had them months ago. Since updates come through adobe and not my email, I instantly flagged it as bullshit. A quick look at the address confirms it.

Originally Posted by Jobe

and? this is supposedly a tech enthusiast forum.

www.click2downloadAvirus.ru

*whistles*

[FrIdGe]

Do you have any domain names and are you the technical/admin contact for them? That's how they got my details.

[Badooleoo]

Originally Posted by Jobe

CONSPIRACY! been getting it for ages in my spam folder. link was a dead giveaway. Sad that you wouldn't have picked up on it being a scam if it weren't for using your name. You need to go back to your learner internet licence.

Well if its taken this long for them to get my details then my internet licence must be pretty robust, hows yours chum?

Originally Posted by qwertylesh

please remove the URLS from your OP as theyre most likely malicious or would lead to something malicious.

Done

Originally Posted by FrIdGe

Do you have any domain names and are you the technical/admin contact for them? That's how they got my details.

No

On top of that searching my name brings up nothing, my email personal address is not used publicly.

Thats why I point the finger at PayPal (even eBay I use a different name from PayPal)

[Grant]

I've got a couple of these emails to email addresses I wouldn't normally create accounts with, so I have a feeling they've been picked up from someone's private address book somewhere (eg. malware that scans through an address book or webmail accounts that have been hacked directly or indirectly through a contact export function) - that's probably why they have real names associated with some addresses.

[qwertylesh]

I never go these until i began emailing chinese vendors, then bam, got heaps.
so thats where i point the blame.

[Jobe]

Originally Posted by Badooleoo

Well if its taken this long for them to get my details then my internet licence must be pretty robust, hows yours chum?


Done


No

On top of that searching my name brings up nothing, my email personal address is not used publicly.

Thats why I point the finger at PayPal (even eBay I use a different name from PayPal)

I assume that's a photo of you looking hard on your deviantART profile? Do you strip out exif data from all image you upload?

EDIT: also you can't control what others put about you on the internets