Don’t open that Western Union Transfer email

Our spam traps have been seeing a widespread malicious attack today, posing as a communication from Western Union.

The emails have a subject line of

Western Union Transfer MTCN: <random number>

and an attached file called

Sign up to our free newsletter.
Security news, advice, and tips.

Malicious email claiming to come from Western Union

Part of the email reads as follows:

The money transfer you have sent on the 13th of March has not been collected by the recipient.
According to the Western Union agreement the transfers which are not received in 15 days are to be returned to sender. To collect cash you need to print the invoice attached to this e-mail and visit the nearest Western Union branch.

Of course, opening the attached file wouldn’t be the smartest move you’ve ever made in life, as it contains a malicious Trojan horse.

Interestingly, the malicious emails append some text to the bottom of each message to make it appear as though your mail gateway has scanned the message and determined it not to be spam. This takes a form similar to the following (where I use the name ‘’ rather than the real recipient’s domain name):

[ : nospam] [EMAILID: [email protected]] [TIME:20090511125648]

Sophos detects the malware, known as Troj/Agent-JUC, and also protects customers of our email gateway products by intecepting the attack as spam.

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.