Home Malware Fake Companies House ‘Important Documents’ Email Contains Malware

Fake Companies House ‘Important Documents’ Email Contains Malware

by Brett M. Christensen

This email, which purports to be from UK Government department Companies House, supposedly contains important and confidential company documents in an attached file. The email claims that you must scan the attached documents and fax them to a specified number.  

The emails appear to come from a genuine .gov.uk address and includes a genuine Companies House phone number. At first glance, it may appear to be a real Companies House notification.

However, the email is not from Companies House and the attachment does not contain company documents as claimed. The email address is spoofed to make it appear legitimate. The attachment contains malware. If you open the attached .zip file, you will find a malicious .exe file inside. Clicking this .exe file can install the malware on your computer. Once installed, the malware may download further malware that can steal personal and financial information such as account passwords and connect to remote servers operated by online criminals.

Companies House is a UK government entity that ‘incorporates and dissolves limited companies, registers the information companies are legally required to supply, and makes that information available to the public’. Thus, at least a few people who own or work for companies in the UK may believe that the email is genuine and inadvertently install malware on their computers.

This campaign is not unprecedented. Another malware email, which was hitting inboxes back in 2013, also claimed to be from Companies House. The earlier version falsely claimed that a complaint had been made against the recipient’s company and contained malware in an attached file. 

Be wary of any email that claims to be from Companies House and instructs you to click a link or open an attached file to view documents or supply information. Some of these fraudulent emails may carry malware. Others may be phishing scams designed to trick you into providing personal and financial information to online criminals.

Example

Subject: MPORTANT – Confidential documents

Company Documents

Case: C8822143
Please scan attached document and fax it to [removed].

All web filed documents (with the exception of downloaded accounts templates) are available to view / download for 10 days after their original submission. Once accepted, these changes will be displayed on the public record. Not yet filing your accounts online? See how easy it is… For enquiries, please telephone the Service Desk on [removed] or email [removed] This email was sent from a notification-only email address which cannot accept incoming mail. Please do not reply directly to this message.

Yours faithfully

[Name Removed]
Senior Manager
Companies House
[Removed]@gov.uk
Calls may be monitored or recorded in case we need to check we have carried out your instructions correctly and to help improve our quality of service.

©2014 Companies House. All rights reserved.

Attachment: CASE_C8822143.zip contains CASE_C9FD9DSGF0F.exe

Companies House Malware

Importance Notice

After considerable thought and with an ache in my heart, I have decided that the time has come to close down the Hoax-Slayer website.

These days, the site does not generate enough revenue to cover expenses, and I do not have the financial resources to sustain it going forward.

Moreover, I now work long hours in a full-time and physically taxing job, so maintaining and managing the website and publishing new material has become difficult for me.

And finally, after 18 years of writing about scams and hoaxes, I feel that it is time for me to take my fingers off the keyboard and focus on other projects and pastimes.

When I first started Hoax-Slayer, I never dreamed that I would still be working on the project all these years later or that it would become such an important part of my life. It's been a fantastic and engaging experience and one that I will always treasure.

I hope that my work over the years has helped to make the Internet a little safer and thwarted the activities of at least a few scammers and malicious pranksters.

A Big Thank You

I would also like to thank all of those wonderful people who have supported the project by sharing information from the site, contributing examples of scams and hoaxes, offering suggestions, donating funds, or helping behind the scenes.

I would especially like to thank David White for his tireless contribution to the Hoax-Slayer Facebook Page over many years. David's support has been invaluable, and I can not thank him enough.

Closing Date

Hoax-Slayer will still be around for a few weeks while I wind things down. The site will go offline on May 31, 2021. While I will not be publishing any new posts, you can still access existing material on the site until the date of closure.

Thank you, one and all!

Brett Christensen,
Hoax-Slayer