With packaging looking legitimate enough at first glance, scammers are sending out fake Microsoft Office USB sticks — loaded with ransomware — to individuals.
As reported by Tom’s Hardware and PCMag, the USBs are sent out to randomly selected addresses in the hopes of convincing targets that they inadvertently received a $439 Office Professional Plus package.
Alongside the bogus USB stick, a product key is also included. However, plugging the USB stick into a system directs the user toward calling a fake customer support line as opposed to an actual launch installation window for Office.
Once connected to the fraud support line, the threat actors attempt to install a remote access program in order to breach and control the target’s PC.
Cybersecurity consultant Martin Pitman confirmed the scam’s existence when his mother called him regarding the package. Because she tried to install what she thought would be Office programs, Pitman was able to get an insight into how the scheme operates.
An alert of a virus is presented to the victim when the USB is plugged in, prompting the user to call a support number. “As soon as they called the number on screen, the helpdesk installed some sort of TeamViewer (remote access program) and took control of the victim’s computer,” he said to Sky News.
Disguised as a Microsoft customer support technician, the individual on the other end of the phone would also ask for payment details.
As highlighted by Tom’s Hardware, postal packages schemes are not among the usual tactics used by criminals. But with the increasing awareness of email scams, it seems scammers are now reverting to sending out physical products.
Microsoft, which has launched an internal investigation into the matter, said it has seen such methods being used in the past, but they’re not widespread.
Robert Pooley, who works as a director at U.K.-based cybersecurity firm Saepio, brought attention to the counterfeit Microsoft Office USB strategy in July. “Quite the scam. Shows how important cyber awareness is at work and home,” he said via a LinkedIn post.
In a similar case that occurred in 2020, security company Trustwave found counterfeit USB sticks, disguised as a Best Buy $50 gift card promotion, were being sent to unsuspecting targets.
