Inboxes are currently being hit by emails that claim that a request for leave has been approved. The emails list the proposed dates for the leave and include a company name. An attached .zip file supposedly contains more information about the leave application.
However, the emails are not genuine company notifications and the attachment does not contain a leave application document.
The .zip file contains a malicious .exe file that, if opened, can install malware on Windows based computers. Once installed, this malware may download even more malware and steal information such as account usernames and passwords.
Details, such as the name of the company supposedly granting the leave and the dates of the leave may vary in different versions of the malware emails.
The criminals responsible for this malware campaign know that at least a few recipients will likely open the attachment because they think that a mistake has been made and they are curious to find out more. Such simple social engineering tricks can be very effective.
If you receive one of these emails, do not click any links or open any attachments that it contains.
Example:
Subject: Application for Leave
Your request for MMMU-3C Leave for the period 30/10/15 to 30/10/15 returning to work on 02/11/15, has been APPROVED
Company: Charles Schwab Corp.
