Malware on Splash of Paint
Home Malware Fake Costco Order Notification Leads to Malware

Fake Costco Order Notification Leads to Malware

by Brett M. Christensen


Email purporting to be from Costco thanks you for your recent order and invites you to view order details by clicking a link. 

Brief Analysis

The email is not from Costco. Clicking the link opens a website that contains malware. Once installed, this malware may collect personal information from your computer and connect with servers operated by criminals. If you receive this email, do not click any links or open any attachments that it contains.


Subject: Thank you for buying from Costco

Our online store received an order and the personal data of the recipient coincide with yours.
You may get your order in the nearest Local Store.
Attention! Your order can be reserved within 4 days.
You may see order details here .
Happy Thanksgiving Day!

Truly yours,

Fake Costco Order Email


Detailed Analysis

According to this ‘thank-you’ email, which purports to be from Costco, the company has received your order and you may pick it up at a local store.

The email invites you to click a link to view details about the supposed order. The message includes the Costco name logo and is designed to emulate a genuine email from the company. 
However, the email is not from Costco and the link does not open information about an order.  Instead, the link opens a website that harbours malware. Clicking the link automatically downloads a .zip file. In the sample I tested, the file was named File names may vary in different incarnations of the scam.

Opening the .zip file reveals a .exe file with a similar name. Clicking this .exe file will install the malware on your computer.

Typically, such malware can harvest sensitive information from the infected computer and send it to online criminals. It may also download and install further malware components and allow the criminals to control the computer from afar.

Criminals often send out bogus order notifications as a means of tricking people into installing malware. The messages have used the names of many high profile companies.

Some versions include the malware in an attached file rather than on a compromised website.

If you receive one of these emails, do not click any links or open any attachments that it contains.

If you have an account with the store named in the email, it is safer to log in by entering the address in your browser’s address bar rather than by clicking a link.

Importance Notice

After considerable thought and with an ache in my heart, I have decided that the time has come to close down the Hoax-Slayer website.

These days, the site does not generate enough revenue to cover expenses, and I do not have the financial resources to sustain it going forward.

Moreover, I now work long hours in a full-time and physically taxing job, so maintaining and managing the website and publishing new material has become difficult for me.

And finally, after 18 years of writing about scams and hoaxes, I feel that it is time for me to take my fingers off the keyboard and focus on other projects and pastimes.

When I first started Hoax-Slayer, I never dreamed that I would still be working on the project all these years later or that it would become such an important part of my life. It's been a fantastic and engaging experience and one that I will always treasure.

I hope that my work over the years has helped to make the Internet a little safer and thwarted the activities of at least a few scammers and malicious pranksters.

A Big Thank You

I would also like to thank all of those wonderful people who have supported the project by sharing information from the site, contributing examples of scams and hoaxes, offering suggestions, donating funds, or helping behind the scenes.

I would especially like to thank David White for his tireless contribution to the Hoax-Slayer Facebook Page over many years. David's support has been invaluable, and I can not thank him enough.

Closing Date

Hoax-Slayer will still be around for a few weeks while I wind things down. The site will go offline on May 31, 2021. While I will not be publishing any new posts, you can still access existing material on the site until the date of closure.

Thank you, one and all!

Brett Christensen,