URGENT:Malware purporting to be from Apple

This arrived in my inbox this morning and thank God I thought it looked suspicious. I checked the order #(redacted) and it did not exist. I then called Apple and he said that I was the 11th caller in the last 90 minutes who had received this e-mail. I did not click the link, but I'm betting that it was to "confirm" credit card information so that scammers could steal it. Apple is aware that this is happening and is working on it.

Just wanted to warn others.

From: Apple Store <[email protected]>
Subject: Thank you for your order
Date: March 12, 2012
To:

Dear Customer,

Thank you for shopping at Apple Store.

We would like to notify you that your Order Number: WXXXXXXX has been successfully charged to your credit card for 3,456.03 USD.

Please CLICK HERE to see your ORDER.

Your Apple Store Customer Service Team

Click to expand...

Thanks for the heads up! It might save someone some grief!

Got the exact same one at 10:39am...I knew it was bogus...and I did click on it....Got error 404 page not found....Called Apple for the **** of it...They corroborated the bogus e-mail...

Did the email actually originate from the apple.com domain? The email you provided in your first post seems to suggest that it did. If not, what domain did it come from? It wouldn't hurt to pass that information along so we can all know what to look for.

I got the a similar this morning for an order from AT&T... I don't have AT&T

Thank you for your recent purchase of AT&T Voice/Data Equipment on transaction (91/order number ******/******).
Could you please take five minutes to let us know how we did? To access the survey, click on the link below or cut and paste the entire link into your browser's address line.

ONCE YOU HAVE SUBMITTED YOUR COMPLETED SURVEY, YOU WILL AUTOMATICALLY BE ENTERED IN A DRAWING TO WIN AN IPAD 2®*!

I removed the link from your post - if this is indeed a spam related problem, we don't need to help them out by giving out the links.

vansmith said:

I removed the link from your post - if this is indeed a spam related problem, we don't need to help them out by giving out the links.

Click to expand...

I didn't think I included the link in the first post, just the word "LINK". It didn't show up on my browser. My apologies if it was included

vansmith said:

Did the email actually originate from the apple.com domain? The email you provided in your first post seems to suggest that it did. If not, what domain did it come from? It wouldn't hurt to pass that information along so we can all know what to look for.

Click to expand...

The "From" information was taken directly from the actual e-mail. That's the only address I have. Is there another way to trace the domain?

class77 said:

I didn't think I included the link in the first post, just the word "LINK"

Click to expand...

I didn't touch your post - that comment was for the post above mine.

vansmith said:

I didn't touch your post - that comment was for the post above mine.

Click to expand...

Thanks for the clarification

class77 said:

The "From" information was taken directly from the actual e-mail. That's the only address I have. Is there another way to trace the domain?

Click to expand...

It depends on the mail client you're using. Some allow you to see more information about the sender which would give you a better sense of where it was coming from.

vansmith said:

It depends on the mail client you're using. Some allow you to see more information about the sender which would give you a better sense of where it was coming from.

Click to expand...

Just using the Apple Mail software. Is there anything I can do to find further info?

This was mine verbatim ... Excluding the live link of Click Here


From: *[email protected]

Dear Customer,

Thank you for shopping at Apple Store.

We would like to notify you that your Order Number: W253465457 has been successfully charged to your credit card for 4,958.01 USD.

Please*"click here"*to see your INVOICE.

Your Apple Store Customer Service Team

Select the message > View > Message > All Headers. That will give you more information and for this thread, we're interested in the "Received" fields which will tell us where the email started, where it went and where it ended up (which would be with you). It's arranged chronologically with the origin at the bottom of the list. Where does it say it originated?

vansmith said:

Select the message > View > Message > All Headers. That will give you more information and for this thread, we're interested in the "Received" fields which will tell us where the email started, where it went and where it ended up (which would be with you). It's arranged chronologically with the origin at the bottom of the list. Where does it say it originated?

Click to expand...

From: Apple Store <[email protected]>
Subject: Thank you for your order
Date: March 12, 2012 9:29:07 AM CDT
To: XXXXXXXXXXX
Return-Path: Same as "From"-deleted because of e-mail link
Received: I deleted this. Was not certain that it might not have the addresses of those it was sent to and wanted to ensure their privacy
X-Caa-Spam: 00000
X-Authority-Analysis: v=2.0 cv=QarRSLnv c=1 sm=1 a=siV9WVqFgvTboKNz5ODPgA==:17 a=N659UExz7-8A:10 a=bfbTxPC6ShgA:10 a=qWt39RqDAAAA:8 a=W86bdoAwunfnoZHJ-F0A:9 a=lk9ESJYJ29nlyUfdSzwA:7 a=pILNOxqGKmIA:10 a=_W_S_7VecoQA:10 a=GN58vHO7ZDYA:10 a=p563do5EzwUA:10 a=nQVTnSuBv8iCc6TP:21 a=_r_tmMOTfCLEBC0N:21 a=siV9WVqFgvTboKNz5ODPgA==:117
X-Mailer: The Bat! (v2.00.8) Personal
X-Priority: 3 (Normal)
Message-Id: <[email protected]>
Mime-Version: 1.0
Content-Type: text/html; charset=Windows-1252
Content-Transfer-Encoding: 7bit

class77 said:

Received: I deleted this. Was not certain that it might not have the addresses of those it was sent to and wanted to ensure their privacy

Click to expand...

That's the part I need. We only need the first one however (bottom one).

This looks legit - it does appear to be coming from an Apple domain. It would appear therefore that something weird is going on at Apple.

That is why I don't click on any links in emails. If they can't say all the information in the email then I think it's suspicious.

Sorry but... just looking at the email I can tell it's not real from the grammar:

Thank you for shopping at Apple Store.

Click to expand...

Not even Apple in Russia would produce that drivel!

Sometimes people make scamming too easy for these jerks.

Doug

Doug b said:

Sorry but... just looking at the email I can tell it's not real from the grammar: Not even Apple in Russia would produce that drivel!

Sometimes people make scamming too easy for these jerks.

Doug

Click to expand...

I was going to write that earlier! Someone forgot the all important definite article "the."

vansmith said:

I was going to write that earlier! Someone forgot the all important definite article "the."

Click to expand...

And what's funny is that "they" do this every. single. time! All one has to do is look for the tell-tale signs! lol

Doug

That's actually the best part of spam.

I always find myself asking "why don't they hire someone who can speak the language to write the messages?" I don't want to call them smart but you think they could figure that one out.