Monday, August 6, 2018

Apple Phishing Email - Deezer Music & Podcast Player by DEEZER, Subscription renewal

For the record, this is an Apple phishing email attempt that is recently going around and made it through span filters. What to do?  Report them, goto bottom of page.

FromAppIe Store

Order Confirmations : Deezer Music & Podcast Player by DEEZER, Subscription renewal renovare volentibus votre plan de facturation [Paid]

It contains two infected PDF files: Deezer Music - Podcast Player Reciept.pdf

 Uploading to to detect the PDF javascript malware we find: 

<</Type/Action/S/URI/URI( >>

What's unique about this attack - VirusTotal did not pick up the malware ?

How to tell this is a Phishing email ?

  1. Check email address in full, if it's not from originating company then it's phishing.
  2. Hover over all links in email, if it's not from the site then forget it.

  3. The best way is to look at message source, see below.

How to examine Email Message Source ?

Now lets look at message source
  1.>Actions->View Message Source. 
  2.>More (down arrow to top right)->Show original.
Check for suspicious links, anything that does not originate from

Report Phishing Email (not as Spam)

  1.>Junk (at Top)->Phishing Scam
  2.>More (downarrow to top right)->Report Phishing 

Report Phishing URLs at Google now 

If you have recievied this email take further action now by click these links


Report phishing at Microsoft and government agencies


Report phishing emails to Apple 

Forward the email to This provides Apple's legal department and law enforcement with useful information to help prevent future phishing emails.

No comments:

Post a Comment