'ICLOUD Outlook Storage' Email Scam

Our examination of the "ICLOUD Outlook Storage" email revealed that the message is malicious spam, commonly referred to as malspam. This fraudulent message falsely asserts that the recipient's Outlook account linked to iCloud is on the verge of reaching its storage limit, resulting in multiple failed message deliveries.

This deceptive notification claims that the undelivered emails can be accessed through the attached files. However, these attachments are, in reality, malicious documents created with the intention of infecting systems with the Agent Tesla Remote Access Trojan (RAT).

The malspam email informs the recipient that their iCloud-linked Outlook account has reached 96.80% of its storage capacity, causing incoming messages to go undelivered. It suggests that these undelivered messages can be reviewed or forwarded to the mailbox by opening the attached file.

It is crucial to emphasize that these claims are entirely false, and this email is not affiliated with either Apple iCloud or Microsoft Outlook.

This fraudulent email includes two attachments titled "UNDELIVERED MAILS.doc" and "UNDELIVERED MAILS 2.doc," both of which have the same appearance and share the objective of introducing the Agent Tesla RAT into devices. These malicious Word documents encourage users to enable editing, as this is how they execute harmful macro commands. The documents contain extensive text related to audits and finances, as a disguise.

As mentioned earlier, these attached files serve to propagate malware.

In summary, individuals who fall victim to emails like "ICLOUD Outlook Storage" are at risk of experiencing system infections, severe privacy breaches, financial losses, and even identity theft.

How Can You Tell an Email is a Scam?

You can often identify a scam email by looking for certain warning signs and red flags. Here are some common indicators that an email may be a scam:

• Sender's Email Address: Check the sender's email address. Be wary of email addresses that use misspelled domain names, generic domains (e.g., gmail.com or yahoo.com for official organizations), or free email hosting services for official communication.
• Generic Greetings: Scam emails often use generic greetings like "Dear Customer" or "Hello User" instead of addressing you by name. Legitimate organizations typically use your name in their emails.
• Spelling and Grammar Errors: Scam emails frequently contain spelling and grammar mistakes. Poorly written content is a strong indicator of a scam.
• Urgent or Threatening Language: Scammers often create a sense of urgency or fear. Be cautious of emails that demand immediate action, threaten consequences, or promise unrealistic rewards.
• Unsolicited Attachments or Links: Do not open attachments or click on links in unsolicited emails. Scammers may use these to deliver malware or phishing pages.
• Requests for Personal or Financial Information: Legitimate organizations will not ask you to provide sensitive information like passwords, Social Security numbers, or credit card details via email. Be skeptical of such requests.
• Too Good to Be True Offers: If an email promises a deal that seems too good to be true, it probably is. Scammers use this tactic to lure victims.
• Misspelled URLs: Hover your mouse over any links in the email (without clicking). Check if the URL matches the official website of the organization it claims to be from. Beware of slight misspellings or variations.
• No Contact Information: Scam emails often lack legitimate contact information or provide only a generic email address.