Interesting new spam..

Rather than the usual “You have voicemail” email with a zipped attachment I came across a few of these today with similar content all claiming to be WhatsApp voicemail. This time they don’t have an attachment but link to (I presume) a hacked website containing a php file that serves a zip file containing a .exe virus.

Received: from ([])
; Wed, 13 Nov 2013 17:37:24 +0000
Received: by (Postfix, from userid 3184)
id 47069B92B43; Fri, 8 Nov 2013 19:38:08 +0700 (NOVT)
Subject: 6 New Voicemail(s)
X-PHP-Script: for,
From: "WhatsApp Messaging Service" <>
X-Mailer: CSMTPConnectionv1.3
Reply-To: "WhatsApp Messaging Service" <>
Mime-Version: 1.0
Content-Type: multipart/alternative;boundary="----------1383914288527CDB3075AF3"
Message-Id: <>
Date: Fri, 8 Nov 2013 19:38:08 +0700 (NOVT)

Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit

WhatsAppYou have a new voicemail!DetailsTime of Call: Nov-05 2013 13:55:57Lenth of Call: 53 secondsPlay*If you cannot play, move message to the "Inbox" folder.2013 WhatsApp Inc

Content-Type: text/html; charset="ISO-8859-1";
Content-Transfer-Encoding: 7bit

--- thecomputerperson MOVED TO PASTEBIN ---


I’ve removed the link in the above email but it did link to:

This entry was posted in Uncategorized. Bookmark the permalink.

Comment on this topic

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s