Beware of fake Amazon order confirmation mails

The next time you receive an Amazon order confirmation mail or message, be careful before clicking on it.  It’s because it could be a Phishing or malspam product.  

Email security company EdgeWave has discovered that, this festive season, attackers are sending “emails disguised as very convincing order confirmations”.

The subject line of these fake confirmation emails could be ‘Your Amazon.com order’, ‘Amazon order details’, or ‘Your order 152-2572400-035071 has shipped’, etc.  

Obviously, such emails come without any details about the order and the tracking information is also missing. The target is asked to click on the Order Details button.  Upon clicking, a Word document gets downloaded and asks you to Enable Content so that you can view properly.  

Upon clicking, macros get automatically triggered.  These macros execute a PowerShell command, which in turn automatically downloads and executes a Trojan, which starts running silently in the background before proceeding to do its ominous task.