Chinese Email Scam Claims “the company address has changed”

The “Please note that the company address has changed” email is a scam designed to trick recipients into believing it is a legitimate business communication. The sender claims that the company’s address has changed and urges the recipient to review an attached file labeled “P232687.pdf.arj.” This email is fraudulent and is intended to either spread malware through a malicious attachment or facilitate a business email compromise (BEC) scam.

This scam is completely fraudulent, and the sender does not represent a legitimate business. The email contains suspicious contact information, including an email address, phone numbers, and a fake company name, which are used to make the email seem authentic. The attachment is likely malicious and may contain malware, ransomware, or spyware designed to infect the recipient’s device.

Receiving this email suggests that your email address has been targeted in a mass phishing campaign or was obtained from a data breach. While your email account itself has not necessarily been hacked, you should avoid interacting with the message and follow the security measures outlined below.

Table of Contents

• What is the “Please Note That the Company Address Has Changed” Email Scam?
• How This Email Scam Works
• Example of the Scam Email
• Steps to Take If You Receive This Email
• What to Do If You Opened the Attachment
• How to Check Your Device for Malware and Protect It

What is the “Please Note That the Company Address Has Changed” Email Scam?

The “Please note that the company address has changed” email is a fraudulent message sent under the guise of a company update. The sender pretends to be a business contact and urges the recipient to review an attachment, which is typically a malicious .arj file.

These types of scams aim to deceive businesses or individuals into downloading and opening the attachment, which may contain malware, ransomware, or a trojan. The ultimate goal could be to infect the recipient’s device, steal sensitive information, or compromise financial accounts.

How This Email Scam Works

This type of scam follows a common pattern, using deception and urgency to manipulate victims. Below is how it typically operates:

• Fake Business Inquiry: The email appears to be a legitimate request regarding a business address change.
• Malicious Attachment: The attachment, usually a compressed file like .arj, is disguised as a document but actually contains malware.
• Data Theft: If opened, the attachment may install keyloggers, trojans, or remote access tools to steal sensitive data.
• Business Email Compromise (BEC): The scam may be used to deceive employees into transferring money or revealing confidential information.

These scams rely on trust and urgency to trick recipients into engaging with the email.

Example of the Scam Email

Below is a full copy of the scam email:

Subject: 新查询# P232687
From: admin.smarterluggage.com
Message:

你好，

请参阅随附的我们的新咨询/报价。尽快审查、处理和确认。

如果您有任何疑问，请随时通过下面列出的电子邮件地址或电话号码与我联系。

Please note that the company address has changed
admin@smarterluggage.com 18106295261

南通棕榈纺织品有限公司

南通市人民中路211号大达国际商业广场24幢1604-1606室

+86 188 2582 1428
+86 15362078058

Skype: daisyresena

ROOM 1604-1606, UNIT 24, DADA BLDG, 211 RENMIN ROAD, NANTONG JIANGSU CHINA

Steps to Take If You Receive This Email

1. Do not open the attachment: The .arj file is likely malware.
2. Do not respond: Any reply confirms your email is active.
3. Report the email: Mark it as phishing in your email client.
4. Block the sender: Prevent further scam emails from this address.

What to Do If You Opened the Attachment

1. Disconnect from the internet: Prevent further malware activity.
2. Run a security scan: Use Malwarebytes to detect and remove malware.
3. Reset account passwords: If you store login details on your computer, change them immediately.

How to Check Your Device for Malware and Protect It

How to Use Malwarebytes:

1. Download and install Malwarebytes.
2. Open Malwarebytes and click Scan.
3. Once the scan is complete, click Quarantine to remove any threats.
4. Restart your device and run another scan to confirm removal.

For ongoing protection, consider Malwarebytes Premium.