Your Ultramar invoice is now available to view

Fake invoices are a common theme for PDF phishing. Be wary if you receive an invoice email that you weren’t expecting, especially if it comes from a company that you don’t have any dealings with. This fake invoice email is relatively well-written, but there are a couple of signs that the attachment isn’t legitimate:

  • The email contains no personalized greeting; this can be a sign of a mass email sent to many recipients, when legitimate invoices are something that are supposed to be individualized.
  • The email is unusually vague and doesn’t give any information about the supposed invoice; it just tells you to look at the attachment. Usually a legitimate invoice or receipt email will mention some basic information about the transaction, such as the total amount or perhaps the billing/order date.

The red flags above are a sign that you shouldn’t open the attachment. InfoSec examined the contents using a secure tool and found that it contains a blurred out picture of an invoice, overlaid with a box that says, “View Protected Document”. If a PDF tells you to click to view protected content, that is a sure sign the PDF is malicious. If you did open the PDF, reach out to your department’s IT support contact immediately for assistance, especially if you clicked on “View Protected Document”.

Fake invoice email directing you to click on a malicious PDF attachment for details

From: Ultramar <support@cobills.com>
Subject: Your Ultramar invoice is now available to view/Votre facture Ultramar est maintenant disponible à la consultation

Attachment: Invoice3421.pdf

Thank you for choosing Ultramar as your product and service provider. We appreciate your business! We would like to remind you that e-Bill is our environmentally friendly billing option.
Please do not reply to this email.
If you have any questions, please see the attached statement for Ultramar contact information.

Merci d’avoir choisi Ultramar comme fournisseur de produits et services. Nous apprécions votre entreprise ! Nous vous rappelons que l’e-Bill est notre option de facturation écologique.
Veuillez ne pas répondre à cet e-mail.
Si vous avez des question, veuillez consulter la déclaration ci-jointe pour les coordonnées d’Ultramar.