AT&T ‘You Have a New Voice Mail’ Malware Email

Outline

Message purporting to be from telecommunications company AT&T claims that a new voicemail could not be delivered to the recipient. The email includes an attached file that supposedly contains the voicemail. 

Brief Analysis

The message is not from AT&T and the attached file does not contain a missed voicemail. Instead, the attachment harbours a malicious .exe file hidden within a .zip file. Opening the .exe file can install malware on the user’s computer.

Example

Detailed Analysis

According to this email, which claims to be from telecommunications giant AT&T, the recipient has a new voicemail. The message advises that the voicemail could not be delivered. The message includes an attached .zip file that supposedly contains a copy of the lost voicemail.

However, the message is not from AT&T and the attached file does not contain an undelivered voicemail as claimed. In fact, hidden inside the attached .zip file there is a malicious .exe file.

This attack is similar to another malware distribution that claims that WhatsApp users have a new voicemail waiting. Clicking the “Play” button in the bogus email will open a malicious website that harbours malware.

And, AT&T customers have been targeted a number of times in the past via both phishing and malware emails.