Fake ‘Witness Subpoena’ Email Contains Macro Malware

The email is not from any legitimate attorney, and the attached document does not contain a genuine subpoena. The attached Word document contains a malicious macro that, if enabled, can download and install malware on your computer.

According to this ‘Witness Subpoena’ email, your case has been appointed for a hearing on a specified date in front of a specified judge. The email, which claims to be from an attorney, urges you to open an attached Subpoena to Appear in Court document to read complete information about the supposed hearing.

The attached file is a seemingly innocuous Microsoft Word (.doc) file.

However, things are not as they may appear. The email is not a genuine court notice message, it is not from a real attorney, and the attached document does not contain a subpoena to appear in court as claimed. In fact, the message is an attempt to trick you into allowing malware to be installed on your computer.

At first glance, the email’s attachment seems to be a harmless Microsoft Word document and you might therefore open it without due forethought. However, if you do attempt to open the document, you will be prompted to enable macros, ostensibly to allow the document’s content to be correctly displayed. If you enable macros as requested, a malicious macro will connect to a server and download and install malware.

The exact nature of the downloaded malware may vary. Malicious macros have recently been used to install ransomware such as Locky as well as trojans that can steal your online banking login credentials and other personal information.

Bogus court notice emails have been used repeatedly to deliver malware in recent years. Some, like this one, include malicious attachments. Others have a link to a compromised website that harbours the malware. Be wary of any unsolicited email that purports to be from a court or law firm that claims that you must click a link or open an attached file to read more information about an impending court case.

If you are unfamiliar with macros and the potential dangers they pose, you can read more about them here.