Fake MalwareBytes billing used for phishing

[steveheinz]

I received this email yesterday and stupidly called the number thinking I had inadvertently upgraded from free MalwareBytes somehow. I was a phishing attempt. I let them on my computer, before I realized what it was. 

They were after information and gift cards.

I reloaded a clean version of MalwareBytes and removed their files from my computer. Here's hoping...

 

Edited May 10 by AdvancedSetup
Removed PII

[David H. Lipman]

Thank you.

We have been seeing a plethora of Fake Invoices.  Yours is a common one with the only difference is that is a new phone number.  But a common denominator has been the From address and the To addresses are the same.

No legitimate company would ever use the recipients email address as the sender.

If you think you are infected, please read;  I'm infected - What do I do now?  and then create a post in;  Windows Malware Removal Help & Support  and you will receive one-on-one assistance in checking your PC and removing any malware found.  It is possible that the actor installed a backdoor trojan when you gave access to your PC.

Please reference:

• 10 Warning Signs You’ve Received a Fake Invoice Email
• Phishers send fake invoices
• Warning: This scam starts with a fake invoice. It could end with crooks stealing your data
• Invoice Fraud: How to Identify Fake Invoices & More
• Malwarebytes:  Fake renewal emails being received

            

Edited May 10 by David H. Lipman
Edited for content, clarity, spelling and/or grammar

[steveheinz]

I'm on an iMac. I've run a new copy of MalwareBytes and the computer came up clean. The computer starts and seems to be running normally. I've reduced the assess settings and changed passwords for the computer and sites that I access.

Anything else that I should do?

Thanks!!

[David H. Lipman]

What you have done are good steps of remediation.  But I am not a Mac user so I can't provide any information for that platform.

There is;  Mac Malware Removal Help & Support  where you can ask that and reference this thread.

Edited May 10 by David H. Lipman
Edited for content, clarity, spelling and/or grammar

[Porthos]

@steveheinz I suggest changing all of your website passwords and enabling 2FA wherever possible.

Also suggest checking your email address here. https://haveibeenpwned.com/

Edited May 10 by Porthos