“Billing Status Overdue”; Emails Contain Macro Malware

The emails are not from any legitimate company and the attachments do not contain invoices. Instead, the attached Microsoft Word documents contain malicious macros that, if enabled, can download and install malware.

A series of emails that claim that you owe money to the sending company are currently hitting inboxes. The emails have a subject line that claims that you billing status is overdue and includes your name or business name along with a reference number for the supposed bill.

The body of the emails lists the amount of the outstanding bill and informs you that an “e-invoice” for the bill is contained in an attached file.

The emails include a signature section that list the name and contact details of the staff member and company that supposedly sent the invoice.

However the emails are not from the companies named in the signature and the attachments do not contain invoices. Instead, the attached Microsoft Word documents contain malicious macros designed to install malware.

The criminals behind this attack bank on the fact that at least a few recipients will open the attachment in the mistaken belief that they have been incorrectly billed. And, because the attachment is a seemingly innocuous Microsoft Word document, many may open it without due caution.

If you do open the attachment, you will be prompted to enable macros, ostensibly because the document is “protected”. If you enable macros as requested, a malicious macro will then download and install malware. The exact purpose of this malware may vary. The malware may be ransomware that can lock your computer’s files and then demand a fee to receive an unlock key. Or it may be malware that can steal sensitive information such as banking passwords from your computer.

Be very cautious of any email that claims that you need to enable macros to view an ordinary document such as an invoice. There is no reason why you should need macros to view such documents. Unless you have a specific need to use them, it is best to leave macros disabled by default.

If you are unfamiliar with macros and the security threats they pose, you can read more about them in this earlier Hoax-Slayer article.

Note that details such as the name and contact information of the sending company and the amount of the supposed bill may vary in different versions of these emails. To make their claims seem more believable, the criminals have used the names and details of real companies in their malware messages.