Bogus Simple Energy Bill Emails Contain Macro Malware
The original site is no longer online; links go to the Internet Archive copy.
What the fact-checkers found
‘eBill’ notification emails purporting to be from electricity and gas retailer Simple Energy are currently hitting inboxes. The emails, which feature the Simple Energy logo and formatting, contain a ‘bill summary’ and claim that you can find your latest gas bill in an attached file.
Payment and account links in the emails open pages on the genuine Simple Energy website.
However, the emails are not from Simple Energy and the attachment does not contain a gas bill.
Instead, opening the attachment can trick you into allowing malware to infect your system.
Because the attachment is a seemingly innocuous Microsoft Word (.doc) file, you may be inclined to open it without realising the risk. If you do open the attachment, a popup message will claim that you need to enable macros before the file can be viewed correctly.
But, enabling macros as requested will allow a malicious macro to run. The macro can download and install other malware components. Typically, such malware can steal information such as banking passwords, download even more malware, and allow criminals to use the infected computer for their own purposes.
For those that may not be aware, a ‘macro’ in this context is a set of instructions that can act as a single command in order to automatically accomplish a task. Macros can save time by making repetitive tasks easier to carry out. Microsoft Office programs and other types of software allow you to create your own macros as required to aid your workflow.
However, macros can also be used maliciously. In the past, macro virus threats were common. Thankfully, later versions of Microsoft Office disabled macros by default thereby lessening the threat posed by macro viruses. But, online criminals are again using macros to trick people into installing malware. Unless you have a specific need to use macros and are aware of the potential risks, you would be wise to leave macros disabled.
If you receive one of these fake Simple Energy bills, do not open any attachments that it contains and do not click any links in the message. Note also that fake energy bill emails have been used in several earlier campaigns to distribute malware.
Got a similar message?
Paste it into the detector and see whether it matches a known hoax.
Check a similar messageRelated fact-checks
Browse the archive →Bogus Invoice Emails Contain Macro Malware
Fake invoice emails that harbour macro malware continue to hit inboxes around the world. Many are brief messages like the example shown below: Subject: Paid Invoices Dear, Please read and ask me any questions.
“Billing Status Overdue”; Emails Contain Macro Malware
The emails are not from any legitimate company and the attachments do not contain invoices. Instead, the attached Microsoft Word documents contain malicious macros that, if enabled, can download and install malware.
‘Attached Tracker For Your Records’ Macro Malware Emails
The emails were not sent by the companies they name and the attachment does not contain a ‘tracker’. Instead, the attached Microsoft Word document contains a malicious macro that, if enabled, can download and install malware that can steal personal…
Fake Password Protected Job Application Emails Contain Macro Malware
Malicious emails that masquerade as harmless job application requests with attached resumes are currently hitting inboxes. The emails ask you to open an attached Microsoft Word file that supposedly contains the sender’s resume.