Fraudulent jConnect fax email spreads malware

There are many email/phishing scams concerning fake fax services such as the eFax scam, but the latest one is concerning  jConnect premiere fax services (j2). This latest fake jConnect email scam also known as the j2 email scam or jConnect fax scam affects all internet users and seems to be more realistic than previous “fax message” email scams essentially used to infect a computer system with a malicious payloads, because the fake jConnect email sent by scam artists may contain real-clickable links that direct to legitimate and safe websites and non-clickable text fabricated to appear as a link that will not display a suspicious and contradicting URL if hovered over.

The primary objective of the jConnect email scam is to trick computer users into downloading an attachment file that claims to contain pages of a faxed message, but instead contains dangerous malware and Trojan horses.

The message and notification sent in the email claims that the recipient has a new Fax Message from a specific caller (Caller-ID) such as Caller-ID 544-676-5544. The subject line of the email will contain information supporting this and the sender will be identified as jConnect using an email address such as message@inbound.j2.com.

The email may appear realistic and may target all internet users, even those who do not use fax services. A sample of the fake email sent from jConnect has been detailed below. Please note, email content may vary.

Fax Message[Caller-ID: 544-676-5544] You have received a 3 page(s) fax at 2012-12-17 03:14:11 EST.* The reference number for this fax is lax3_did12-1201649063-7121973763-11.This message can be opened using your PDF reader. If you have not already installed j2 Messenger, download it for free:http://www.j2.com/downloadsPlease visit http://www.j2.com/help if you have any questions regarding this message or your j2 service.Thank you for using jConnect!Home     Contact     Login2011 j2 Global Communications, Inc. All rights reserved.jConnect is a registered trademark of j2 Global Communications, Inc.This account is subject to the terms listed in thejConnect Customer Agreement.

You have received a 3 page(s) fax at 2012-12-17 03:14:11 EST.

* The reference number for this fax is lax3_did12-1201649063-7121973763-11.

This message can be opened using your PDF reader. If you have not already installed j2 Messenger, download it for free:http://www.j2.com/downloads

Please visit http://www.j2.com/help if you have any questions regarding this message or your j2 service.

Thank you for using jConnect!

How to deal with the jConnect email scam

• If you received an email from jConnect or j2 and are not experienced with online fax services DO NOT OPEN the email, avoid and delete the dangerous and fraudulent email. These email scams are related to very-severe forms of computer viruses including cryptoviruses such as ransomware that are initially introduced via Trojan horses.
• If you clicked links contained in the fake email sent from j2 services it is recommended to immediately scan your computer for malware and viruses that may have infiltrated your computer system using Malwarebytes Anti-Malware software:

1. Install the free or paid version of Malwarebytes Anti-Malware software.

   

2. Once Malwarebytes is installed, run the program. If you are using the free version of Malwarebytes you will be prompted to update the database, please do so.

3. Navigate to the first tab labeled “Scanner” and select the Perform full scan option. Click the Scan button to perform a full system scan. Malwarebytes will automatically detect malware that has infected your computer system.

4. Once the full system scan is complete, Malwarebytes may prompt a message stating malicious objects were detected. Select the malicious objects and click the Remove Selected button to completely remove the malicious files from your computer (the image below shows a file that is NOT selected).