Have You Ever Received Abnormal Emails with Company Logo?

In the last 1 week, I received 3 abnormal e-mails with Vodafone logo and 1 abnormal e-mail with Turkcell logo. When I investigated the incoming e-mails, the color of the work was revealed. The e-mail from the address “mms@mms.vodafone.com” said that I had 1 mms message and if I wanted, I could see the jpeg image of the mms sent from the attachment file for free.

Fake VODAFONE Email:

I opened the zip file in Virtual Machine in case of a virus and bingo! An application called Vodafone network MMS-0676078.jpeg.exe. 57 Kb in size. I then called Vodafone Customer Service and explained the situation. They thanked me and said they would look into the matter.

A few days after this incident, I received an email on my cell phone on my way home from work. Since I drive, I parked my car when I got home and curiously read the message. The email with the subject of Invoice Notification from the email address turkcellkurumsaltahsilat@haberdaret.turkcell.com.tr is as follows:

Değerli Müşterimiz,

Your invoice information dated 25.11.2012 belonging to your company Yalçın Kardeşler Halı Tek.San.Ve Tic.Ltd is attached to your attention. The total invoice amount is 1.401,55 TL and the last payment date is 06.12.2012.
Details are in the attached file.
You can make your payments from our contracted bank branches and give automatic payment instructions for your new invoice payments.Your invoice information dated 25.11.2012 belonging to your company Yalçın Kardeşler Halı Tek.San.Ve Tic.Ltd is attached to your attention. The total invoice amount is 1.401,55 TL and the last payment date is 06.12.2012.
Details are in the attached file.
You can make your payments from our contracted bank branches and give automatic payment instructions for your new invoice payments.

Your next month’s account cut-off date is 25.12.2012 and your last payment date is 07.01.2013.

Sincerely
Turkcell Iletisim Hizmetleri A.S.

This message has been sent for informational purposes.
For questions and comments regarding your invoices, you can call 444 0 532 Turkcell Customer Services.”

Fake Turkcell Email:

It said that I owed money and that I had to click on one of the two links below to pay the debt, and that a pdf file with the billing information was attached to the email. Of course, I unzipped the email attachment in Virtual Machine again, and again the same method. This time an application file called Fatura_Bildirimi.pdf.exe, again 56 Kb in size. I called Turkcell Customer Service to inform them about it and they thanked me and closed it.

I don’t know if Turkcell and Vodafone will be interested in the issue, but I wanted to share and inform you here. Be you, do not open such abnormal e-mails.

For now, I have not received such an email on Avea, but it will come soon. If it comes, I will share it with you here.

I received an email using the name Turkish Airlines Inc. The method is the same. In the incoming email, it sends me a file with online check-in information as if I had booked an e-ticket and when I open it, I see a 55 Kb Turkish-Airlines-Itinerary.pdf.zip application file. I called THY officials and confirmed that the anomalous email was fake. Beware of this new type of virus distribution that has increased in recent days and think twice before opening the attachment files you receive.

THY Fake Email

Dear,Thank you for booking online. Thank you for choosing Turkish Airlines.You can find your Itinerary in the attached file.

Pay and Fly… From now on you may use our web site to pay your Ticket By Office bookings.	Reservation Code: VEJ23P Process date: Mon, 24 Dec 2012 21:26:21 +0900	Reservation Code:	VEJ23P	Process date:	Mon, 24 Dec 2012 21:26:21 +0900
Reservation Code:	VEJ23P
Process date:	Mon, 24 Dec 2012 21:26:21 +0900

	For online check-in please click here		Click here to see your reservation information.
	To book your hotel please click here.		For rent a car please click here. Miles&Smiles members can rent a car online.
You can inform us by filling out contact form , or sending e-mail to CUSTOMER@thy.com , or call Internet Sales Service Center for any problems you may encounter with the bookings made through Online-Ticket Web Site. Please note, mentioned working hours are in local time.

Last but not least

As I receive fake e-mails, I will share them with you. I have just received the same infected file from supportFR@finansbank.com.tr using the name of Finans Bank.

It’s in the inbox and there is a 55 kb application file in it.
finansbank extract.pdf.zip When I opened the file, I saw the infected file. Attention.

Fake Finance Bank Email:

Total Debt of your Finansbank Credit Card with last 4 digits 1857: 593.19 TL Minimum Debt: 603.00 TL Last Payment Date: 03/01/2013. Finansbank Fr:Finansbank. The information contained in this e-mail (including attachments) is confidential and may not be disclosed to third parties without our consent. Fake KuveytTürk Bank Abnormal Email: I just received a fake email using the name of KuveytTürk Bank. I am sharing it with you, do not download the attachment. It has a 55 kb virus. Fake KuveytTürk Email: Subject:Kuveyt Turk Parolaniz Gönd.:supportsms@kuveytturk.com.tr Attach: extract.pdf.zip Message: INTERNET SUBE GIRIS SMS PAROLANIZ: 76434888 Fr:KUVEYT TURK The information contained in this e-mail (including attachments) is confidential. It cannot be disclosed to third parties without our consent. Fake DHL Express Co. Email: I received a fake email sent using the name DHL Kargo and I wanted to share it with you. I will not write not to download the plugin because the number of these is increasing day by day. I'm just sharing it for information purposes.

-------------------------------------------------------------