Warning Sign - Malware Ahead
Home Malware Fake Ticketmaster Purchase Order Email Contains Malware

Fake Ticketmaster Purchase Order Email Contains Malware

by Brett M. Christensen


Email purporting to be from large ticket sales and distribution company Ticketmaster thanks you for purchasing tickets and advises you to open an attached file to review order details. 

Brief Analysis

The email is not from Ticketmaster and the attachment does not contain ticket order details. In fact, the attached .zip file hides a dangerous executable file that, if opened, can install malware on your computer. The malware files attempt to masquerade as innocuous PDFs.


Subject: International Express-Ticketmaster

Thank you for purchasing tickets on Ticketmaster.

Your order number for this purchase is 89-25628/AUS.Complete order detail is attached to this e-mail.

You will receive your tickets via: International Express-Ticketmaster will mail these within 2 business days of the booking. Tickets usually arrive within 10 working days of posting.

Total Charge: AU $121.80

Thank you for adding Event Ticket Insurance to your order. You will be billed AU $13.00 (AU $6.50 per ticket) separately.

Please note: for any ticket-related issues, please continue to contact Ticketmaster Customer Service.
Thanks again for using Ticketmaster.

Note: Email contains an attachment named: ‘This_is_your_ticket_ticketmaster_pdf.zip


Detailed Analysis

This email, which purports to be from ticket sales and distribution company, Ticketmaster, thanks you for your ticket purchase and advises that your tickets will be mailed within two business days.

The email quotes the price of the purchased tickets and claims that you can review details of the ticket order by opening an attached file. 
However, the email is not from Ticketmaster. It is an attempt by online criminals to trick you into installing malware on your computer.

The criminals hope that users will be panicked into opening the attached file because they think that their credit card has been fraudulently used to purchase expensive tickets.

If you open the attached .zip file, a malicious .exe or .pif file will be revealed. If you then open this file, malware will be installed on your computer.

The actual malware payload may vary. Typically, however, such malware can steal sensitive information such as passwords from your computer, download other types of malware, and allow criminals to control your computer from afar.

Details, such as the supposed cost of the tickets, may vary in different incarnations of the scam message.

If you receive one of these fake Ticketmaster emails, do not open any attachments or click any links that it contains.

Importance Notice

After considerable thought and with an ache in my heart, I have decided that the time has come to close down the Hoax-Slayer website.

These days, the site does not generate enough revenue to cover expenses, and I do not have the financial resources to sustain it going forward.

Moreover, I now work long hours in a full-time and physically taxing job, so maintaining and managing the website and publishing new material has become difficult for me.

And finally, after 18 years of writing about scams and hoaxes, I feel that it is time for me to take my fingers off the keyboard and focus on other projects and pastimes.

When I first started Hoax-Slayer, I never dreamed that I would still be working on the project all these years later or that it would become such an important part of my life. It's been a fantastic and engaging experience and one that I will always treasure.

I hope that my work over the years has helped to make the Internet a little safer and thwarted the activities of at least a few scammers and malicious pranksters.

A Big Thank You

I would also like to thank all of those wonderful people who have supported the project by sharing information from the site, contributing examples of scams and hoaxes, offering suggestions, donating funds, or helping behind the scenes.

I would especially like to thank David White for his tireless contribution to the Hoax-Slayer Facebook Page over many years. David's support has been invaluable, and I can not thank him enough.

Closing Date

Hoax-Slayer will still be around for a few weeks while I wind things down. The site will go offline on May 31, 2021. While I will not be publishing any new posts, you can still access existing material on the site until the date of closure.

Thank you, one and all!

Brett Christensen,