Warning: new spamming techniques are on the rise

Unsubscribe spam emails and Walmart phishing campaigns target personal data

Two new spams are actively spreading on the internet

Recent discoveries show that spam and phishing emails have evolved. Two new campaigns were recently reported. One urges users to unsubscribe from a non-existent service, the other one to send a “correct” shipping address because a package from Walmart couldn't be delivered. Both of them could affect millions of people.

During the former one's campaign, tons of emails are sent out to people urging them to press either of two buttons – subscribe or unsubscribe. Although these emails don't state what you're unsubscribing from or subscribing to. According to research, there are three email subjects used:^[1]

• We_need your confirmation asap;
• Request , please confirm your subscription;
• Verification.

Pushing either of those buttons or interacting with the message in any other way than deleting it would help the spam campaign distributors to verify that the email is being used and that's it's prone to further phishing campaigns. In other words, if you press any buttons or reply to the spam message, you will start receiving tons of spam or phishing^[2] emails.

Please note that legitimate companies never send out emails pushing you to subscribe/unsubscribe to/from their services without informing you what the email is referencing. If you received a similar email to your mailbox, please get rid of it immediately.

Researchers have reported^[3] that replying to an email from subscribe/unsubscribe spam campaign results in receiving tons of various spam or phishing messages that will never end. The latter ones are very dangerous as they're aiming to get your personal details or access to your accounts.

A new Walmart phishing campaign is gunning for your personal information

Phishing emails appearing to originate from Walmart (emphasis on appearing) with the subject line “Your Package delivery Problem Notification lD#” are being sent out in tens of thousands. Their primary purpose is to steal personal information^[4] from unaware users.

The message within the phishing email is relatively short and informs the soon-to-be victim that there was a discrepancy with the shipping address; thus, an imaginary package couldn't be delivered. The message urges users to press the “Update Address” button to provide their “correct” shipping address.

If the button is clicked, the device's email client creates a new email with the subject line “Update my Address!”. There are tons of recipient email addresses, presumably controlled by cybercriminals. The whole message reads:

Unfortunately we were not able deliver your postal package in time because your address is not correct. Please reply us with the correct shipping address.

If you ever receive such an email, please be advised that it's a part of an extensive Walmart phishing campaign. The mentioned delivery is non-existent as it is meant to compel you to click the suggested button and provide your personal details. Delete the email and watch out for similar scams.

Giving up personal details might cause privacy concerns

By forwarding your personal information in an email or a treacherous site, you provide cybercriminals with many malicious opportunities. They could try to get access to your accounts (email, bank, social media, etc.), try to lure out your money, infect your devices with malware,^[5] open up new bank accounts in your name, or use the details in any other way that could be profitable to them.

If you've provided your sensitive information to evildoers behind the Walmart phishing attacks or any other unreliable source, you have to take action to prevent identity theft. You can either keep an eye out for your credit report or even put a temporary freeze on it. That would block banks and other institutions from opening any new accounts in your name.

Also, please keep in mind that giving up your email address will result in an increased number of various spam and phishing email. Learn how to identify them to never fall for the cybercriminals' tricks again.