Avoid installing a trojan spread by the "HARASSMENT COMPLAINT" email
Written by Tomas Meskauskas on (updated)
What is "HARASSMENT COMPLAINT" email scam?
"HARASSMENT COMPLAINT" is an email scam designed to proliferate TrickBot trojan-type malicious software. This scam employs social engineering (scare tactics) to trick users into opening the attached file, consequently infecting the system with TrickBot. The user's personal details (such as name, workplace, etc.) are used in an attempt to give the impression of legitimacy.
The email is allegedly from the U.S. Equal Employment Opportunity Commission, claiming that the addressee (individual, to whom the letter is intended) is the subject in a filed sexual harassment complaint. Spam campaigns used to send scam/deceptive emails such as this often disguise the messages as "official", "important", and similar priority mail.
Note that they often contain spelling errors and other inconsistencies, which ease their identification as fraudulent mail. You are expressly advised against opening suspicious and/or irrelevant emails. Attachments and links found within them must never be opened, as they are the source of potential system infections.
The "HARASSMENT COMPLAINT" scam typically targets employees of certain enterprise companies. They are chosen based on the probable workplace scenario (i.e., whether the personnel is large and/or mixed, etc.).
Throughout the message, the addressee's workplace title and/or name is mentioned (possibly, other personal details as well) so as to increase the scam's chances of succeeding by evoking an emotional response. Therefore, it is intended that the user open the attached document without much consideration.
The email states that a complaint of inappropriate behavior has been lodged against the addressee. Therefore, they are currently within the investigation for actions classed as sexual harassment involving a coworker. The infectious attachment is a Microsoft Word document disguised as the harassment grievance report.
The text within informs the recipient that the complaint has been reviewed by a U.S. Equal Employment Opportunity Commission (EEO) representative. Furthermore, the EEO representative has decided to open an investigation on the case. The Word document contains malicious macro commands.
If this file is opened with an MS Word version released prior to 2010, it automatically begins downloading/installing TrickBot. If, however, the version is later, the document requests macro commands to be enabled (to allow editing). The infection then occurs after macros are enabled.
If you suspect that TrickBot (or similar malware) is already present on the device, use anti-virus/anti-spyware software to immediately remove it.
| Name | HARASSMENT COMPLAINT spam |
| Threat Type | Trojan, password-stealing virus, banking malware, spyware. |
| Hoax | Cyber criminals claim to be representatives of the U.S. Equal Employment Opportunity Commission informing the user of a harassment complaint. |
| Attachment(s) | Microsoft Office document (-victim's name-Harassment grievance report [phone number].doc) |
| Detection Names | BitDefender (Trojan.GenericKD.41991007), ESET-NOD32 (VBA/TrojanDownloader.Agent.QHL), Kaspersky (HEUR:Trojan-Downloader.MSOffice.Agent.), DrWeb (Exploit.Siggen.37835), Full List Of Detections (VirusTotal) |
| Symptoms | Trojans are designed to stealthily infiltrate the victim's computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine. |
| Payload | TrickBot |
| Distribution methods | Infected email attachments, malicious online advertisements, social engineering, software 'cracks'. |
| Damage | Stolen passwords and banking information, identity theft, the victim's computer added to a botnet. |
| Malware Removal (Windows) | To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
Social engineering and scare tactics are often used in scam campaigns. They urge users to open dangerous attachments, web links and similar, for various nefarious purposes. For example, the attached files (or links leading to them) can be used to spread trojans, ransomware and other malware.
Cyber criminals attempt to disguise these deceptive emails as official and important mail. Telltale signs of these messages can be various spelling and grammatical errors, and other inconsistencies. For example, the "HARASSMENT COMPLAINT" email scam contains misspelling of the word 'harassment'.
Additionally, some content does not match: the email uses the California state forms with a U.S. Federal agency logo.
Thousands of varied email scams are proliferated including, for example, Ministry of Justice Email Virus, Please Yourself Email Scam, and TOYOTA LOTTERY ORGANIZATION Email Scam to name a few. The TrickBot trojan, which is spread via the "HARASSMENT COMPLAINT" scam, shares similarities with Nymeria, FormBook, Adwind, and many other malicious programs.
How did "HARASSMENT COMPLAINT email scam" infect my computer?
Deceptive/Scam emails infect systems through attached files. The attachments can be Microsoft Office and PDF documents, archive (ZIP, RAR) and executable (.exe, .run) files, JavaScript, etc., however, they are not presented as email attachments. They can be hosted elsewhere and accessed through links listed in the messages.
When the dangerous files are run, executed or otherwise opened, they are triggered to initiate the process of downloading/installing malware. For example, Microsoft Office documents cause infections via macro commands. They request users to enable macro commands. Once enabled, the infection process begins.
How to avoid installation of malware
Suspicious or irrelevant emails should not be opened, especially those received from unknown senders (addresses). Attached files (or web links leading to them) found in dubious mail should never be opened, as they are the source of potential system infections. Use Microsoft Office versions released after 2010.
Newer releases have "Protected View" mode, which prevents malicious documents from downloading/installing malware. Content should be downloaded only from official and verified download channels.
P2P sharing networks (BitTorrent, eMule, Gnutella, etc.), free file-hosting sites, third party downloaders and similar channels are untrusted and more likely to offer malicious content (disguised as and/or bundled with normal software). Program activation and updating should be done via functions/tools provided by legitimate developers.
You are advised against using illegal activation ("cracking") tools or third party updaters. It is imperative to have a reputable anti-virus/anti-spyware suite installed and kept up-to-date. Carry out regular system scans and immediately remove detected issues/threats.
If you have already opened the "HARASSMENT COMPLAINT" email scam attachment, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.
Text presented in the "HARASSMENT COMPLAINT" email attachment:
U.S. EQUAL EMPLOYMENT OPPORTUNITY COMMISSION
HARASSMENT COMPLAINT
EMPLOYMENT
The completion and submission of complainantís form has initiated an intake interview with a U.S. Equal Employment Opportunity Commission (EEO) representative. This is an official proof of a filed complaint. The EEO representative has determined that the complaint can be accepted for investigation.
Instant automatic malware removal:
Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.
Quick menu:
- What is HARASSMENT COMPLAINT spam?
- Types of malicious emails.
- How to spot a malicious email?
- What to do if you fell for an email scam?
Types of malicious emails:
Phishing Emails
Most commonly, cybercriminals use deceptive emails to trick Internet users into giving away their sensitive private information, for example, login information for various online services, email accounts, or online banking information.
Such attacks are called phishing. In a phishing attack, cybercriminals usually send an email message with some popular service logo (for example, Microsoft, DHL, Amazon, Netflix), create urgency (wrong shipping address, expired password, etc.), and place a link which they hope their potential victims will click on.
After clicking the link presented in such email message, victims are redirected to a fake website that looks identical or extremely similar to the original one. Victims are then asked to enter their password, credit card details, or some other information that gets stolen by cybercriminals.
Emails with Malicious Attachments
Another popular attack vector is email spam with malicious attachments that infect users' computers with malware. Malicious attachments usually carry trojans that are capable of stealing passwords, banking information, and other sensitive information.
In such attacks, cybercriminals' main goal is to trick their potential victims into opening an infected email attachment. To achieve this goal, email messages usually talk about recently received invoices, faxes, or voice messages.
If a potential victim falls for the lure and opens the attachment, their computers get infected, and cybercriminals can collect a lot of sensitive information.
While it's a more complicated method to steal personal information (spam filters and antivirus programs usually detect such attempts), if successful, cybercriminals can get a much wider array of data and can collect information for a long period of time.
Sextortion Emails
This is a type of phishing. In this case, users receive an email claiming that a cybercriminal could access the webcam of the potential victim and has a video recording of one's masturbation.
To get rid of the video, victims are asked to pay a ransom (usually using Bitcoin or another cryptocurrency). Nevertheless, all of these claims are false - users who receive such emails should ignore and delete them.
How to spot a malicious email?
While cyber criminals try to make their lure emails look trustworthy, here are some things that you should look for when trying to spot a phishing email:
- Check the sender's ("from") email address: Hover your mouse over the "from" address and check if it's legitimate. For example, if you received an email from Microsoft, be sure to check if the email address is @microsoft.com and not something suspicious like @m1crosoft.com, @microsfot.com, @account-security-noreply.com, etc.
- Check for generic greetings: If the greeting in the email is "Dear user", "Dear @youremail.com", "Dear valued customer", this should raise suspiciousness. Most commonly, companies call you by your name. Lack of this information could signal a phishing attempt.
- Check the links in the email: Hover your mouse over the link presented in the email, if the link that appears seems suspicious, don't click it. For example, if you received an email from Microsoft and the link in the email shows that it will go to firebasestorage.googleapis.com/v0... you shouldn't trust it. It's best not to click any links in the emails but to visit the company website that sent you the email in the first place.
- Don't blindly trust email attachments: Most commonly, legitimate companies will ask you to log in to their website and to view any documents there; if you received an email with an attachment, it's a good idea to scan it with an antivirus application. Infected email attachments are a common attack vector used by cybercriminals.
To minimise the risk of opening phishing and malicious emails we recommend using Combo Cleaner Antivirus for Windows.
Example of a spam email:
What to do if you fell for an email scam?
- If you clicked on a link in a phishing email and entered your password - be sure to change your password as soon as possible. Usually, cybercriminals collect stolen credentials and then sell them to other groups that use them for malicious purposes. If you change your password in a timely manner, there's a chance that criminals won't have enough time to do any damage.
- If you entered your credit card information - contact your bank as soon as possible and explain the situation. There's a good chance that you will need to cancel your compromised credit card and get a new one.
- If you see any signs of identity theft - you should immediately contact the Federal Trade Commission. This institution will collect information about your situation and create a personal recovery plan.
- If you opened a malicious attachment - your computer is probably infected, you should scan it with a reputable antivirus application. For this purpose, we recommend using Combo Cleaner Antivirus for Windows.
- Help other Internet users - report phishing emails to Anti-Phishing Working Group, FBI’s Internet Crime Complaint Center, National Fraud Information Center and U.S. Department of Justice.
Outstanding!
▼ Show Discussion