Social Engineering — 63 posts

A top VIP in one of the African Countries is in dire need of an entrepreneur or fund manager that can confidently receive and manage the sum of US$5.2 Billion. Written as a reply, sent from a Gmail address that misspells its own sender's surname, and offering a nameless fortune to whoever reads a company mailbox, on two conditions: that they own a company, and that the company has a bank account for the money to go into.

My name is Ms. Helen Rudoff, secretary to (Coalfax Holding Ltd London UK) a private investor and a big time financial service provider. A cold loan offer sent under Investing.com's address for a London company that the UK companies register does not list, promising $10 Billion and above in the subject and one billion dollars in the body, and asking for only one thing: your WhatsApp number.

We have paused all upload and sync activities for your account. New data is not being saved. A storage-full alert that never names its provider, sent twice under two different stories — URGENT Renewal attempt failed from Billing Support, and Your account has been disabled from Payment System — from two unrelated business domains, with both of its links parked in a stranger's Google Cloud Storage bucket, and an unsubscribe link that hands you to a three-month-old domain asking you to type in your email address.

Please find the attached document for your attention and consideration. Kindly provide the requested quotation at your earliest convenience. Five polite sentences, a one-word subject and no attachment: a quotation request that names no product, no company and no person, sent from a Gmail account to itself with the recipient blind-copied.

You have been randomly selected to receive a €4,500,000 donation. A Cantonese-language donation fraud signed in the name of a real German research foundation, sent from borrowed mailboxes in Brazil, Ukraine and Indonesia, and routing replies to a misspelled Gmail address.

This is a official email. We are the Domain Registration Service company in Shanghai, China. The Chinese domain name registration scam, back for the third time in our archive, sent from a nine-month-old domain with the same phone numbers and the same Shanghai address as the version we dissected in June 2024.

I am MacKenzie Scott, ex-wife of Amazon CEO and founder Jeff Bezos. A Chinese-language donation fraud promising USD 100,800,000 through a foundation that does not exist, sent from a German online shop's info mailbox under a subject line that is only Re:.

Please I'm consulting you for my personal investment plan. An advance-fee approach signed in the name of Ukraine's First Lady, sent from a car dealership's mailbox at a UAE internet provider, asking you to reply to a Gmail address.

You have Two (2) Messages Pending Delivery on Your E-mail Portal. A notice claiming to be your own domain's web administrator, sent from an animal-feed company's accounts mailbox, whose button opens a page the attacker uploaded into a Google Cloud Storage bucket.

Your payment has been successfully processed. Please find the attached SWIFT advice and supporting documentation for your records. Four lines of flawless business English, a Re: subject line for a conversation that never happened, and a 140 KB PDF that is the entire attack.