A new (or new to me) scam? Anyone seen this one before?

britechguy

Well-Known Member
Reaction score
5,046
Location
Staunton, VA
Over the last 2 days, on 2 separate email addresses, I have received two eerily similar messages from 2 different people I know and who definitely don't know each other. The first is even weirder as his image was in the middle of the "stamp:"

1764260388892.png

1764260478953.png


I've never gotten anything like this, let alone 2 in rapid succession.

The first downloads an MSI file (which of course, I did not run) but which is not being flagged as malicious, but even what the pop-up information for the file shows:
1764260659925.png

with "ScreenConnect Software" as the authors screams scam. Here's what virustotal.com has to say about that MSI file, and none of the major engines flag it: https://www.virustotal.com/gui/file/acad1f9d0a4d58b6ecdf923a6447139feace645fc8d7ff790495ad7d5e50ac9e

Just wondering if anyone's seen this particular thing out there in the wild either before now, or popping up recently?

I doubt there's any point in telling the purported originators about this, as all of this sort of thing tends to come from having culled email addresses from cyberspace and the sender is not who it claims to be from at all. And, of course, neither has my email address in the To: field. One is bcc-ed and the other has nothing that shows as far as directly being addressed to me.
 
This one I see all the time, it's a legit remote control software - even if I only see it used by scammers...

Well, in this case, it wasn't the name of the software, per se, that screamed "scammer" but the context surrounding the MSI that downloads. There would be no legitimate reason for any e-vite to include such unless it were coming from your own support tech and telling you that they want to set up a session with you using that software (and where you were the one who initiated the entire sequence of communication).

I was just trying to fill in some of the specific "why this is so, so fishy" details in this specific instance. There are plenty more. But this is my first experience with this exact sort of scam. I've let the two individuals whose emails were used as the seeming origin point know about this, not because I think they had anything to do with it, or can do anything to fix it, but so if others who received same start replying to them they won't be thinking, "WTF is this about?!"
 
"EventJoyful.msi" - These scammers aren't helping the stereotype of scammers being foreigners who can't speak proper English and therefore name things the most cheesy thing imaginable.
 
Back
Top