Home Malware ‘BP Fuel Card e-Bill’ Excel Macro Malware Email

‘BP Fuel Card e-Bill’ Excel Macro Malware Email

by Brett M. Christensen

BP Fuel Card Macro Malware

 

This email purports to be from a fuel card provider and claims to contain an e-bill for a BP fuel card in an attached Microsoft Excel file.

However, the email is certainly not from any legitimate fuel card services company and the attachment does not contain a fuel bill. If you do open the attachment, you will be prompted to enable macros, ostensibly so that the ‘bill’ can be correctly displayed.

But, alas, once macros are enabled, a malicious macro can run.  The macro can download and install various other kinds of malware. Once installed, this malware can steal sensitive information such as passwords and allow criminals to access and control the infected computer.

If you receive one of these emails, do not open any attachments or click any links that it contains. And, unless you have a specific reason for using macros, it is best to leave them disabled in Microsoft Office.

If you are unfamiliar with macros and their potential dangers,  please refer to this other Hoax-Slayer article, which provides more information about the topic.




EXAMPLE:

Subject: BP Fuel Card E-bill 0200442 for Account B216552 31/01/2016

Please note that this message was sent from an unmonitored mailbox which
is unable to accept replies. If you reply to this e-mail your request
will not be actioned. If you require copy invoices, copy statements,
card ordering or card stopping please e-mail [removed] quoting your account number which can be
found in the e-mail below. If your query is sales related please e-mail
[removed]

E-billing

Subject: BP Fuel Card E-bill 0200442 for Account B216552 31/01/2016

Account: B216552

Please find your e-bill 0200442 for 31/01/2016 attached.

To manage you account online please click
[removed]

If you would like to order more fuel cards please click
[removed]

If you have any queries, please do not hesitate to contact us.

Regards

Cards Admin.
[Name of fuel card provider removed]

Supplied according to our terms and conditions. (see
[removed]

Email includes an attached file called: ‘ebill0200442.xls’




Last Updated: February 5, 2016
First published: February 5, 2016
By Brett M. Christensen
About Hoax-Slayer

References
Macro Virus Threat Returns – Beware Emails With Malicious Word Attachments

 

Importance Notice

After considerable thought and with an ache in my heart, I have decided that the time has come to close down the Hoax-Slayer website.

These days, the site does not generate enough revenue to cover expenses, and I do not have the financial resources to sustain it going forward.

Moreover, I now work long hours in a full-time and physically taxing job, so maintaining and managing the website and publishing new material has become difficult for me.

And finally, after 18 years of writing about scams and hoaxes, I feel that it is time for me to take my fingers off the keyboard and focus on other projects and pastimes.

When I first started Hoax-Slayer, I never dreamed that I would still be working on the project all these years later or that it would become such an important part of my life. It's been a fantastic and engaging experience and one that I will always treasure.

I hope that my work over the years has helped to make the Internet a little safer and thwarted the activities of at least a few scammers and malicious pranksters.

A Big Thank You

I would also like to thank all of those wonderful people who have supported the project by sharing information from the site, contributing examples of scams and hoaxes, offering suggestions, donating funds, or helping behind the scenes.

I would especially like to thank David White for his tireless contribution to the Hoax-Slayer Facebook Page over many years. David's support has been invaluable, and I can not thank him enough.

Closing Date

Hoax-Slayer will still be around for a few weeks while I wind things down. The site will go offline on May 31, 2021. While I will not be publishing any new posts, you can still access existing material on the site until the date of closure.

Thank you, one and all!

Brett Christensen,
Hoax-Slayer