# MA-597.042016: MyCERT Alert - Phishing Attempt by Impersonating Email from Lembaga Hasil Dalam Negeri (LHDN)

**Date:** 29 Apr 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-597.042016  
**Advisory ID:** MA-597.042016

---

CMS MYCERT Advisories Administration Welcome, Author Advisories 1 ! Advisories Administration Home Advisories Administration Update Advisory Field marked \* are mandatory Advisory TitlePhishing Attempt by Impersonating Email from Lembaga Hasil Dalam Negeri (LHDN) Advisory TypeNew Advisory CategoryAlert Advisory Content \*
#### **1.0 Introduction** Recently MyCERT had received several incidents 
*Figure 1.0 Scam Email as from 'LHDN'*
2.2 Referring to Figure 1.0, the user is asked to click on the URL provided in the email. The URL takes the user to a fake LHDN website show in Figure 2.0 below.
*Figure 2.0: Fake LHDN website*
2.3 Users are informed that they are eligible to receive a tax refund of some amount of money and that LHDN needs their bank information. Users that click on either of the bank's selection option will be directed to the fake banking website.
*Figure 2.1: Fake AmBank's Internet Banking websiteFigure 2.2: Fake CIMB's Internet Banking websiteFigure 2.3: A list of Fake Banking Website*3.0 Phishing Site**
The analysis we conducted indicates there are several different phishing URLs hosted on different IPs. As of now, we have notified the respective hosting providers to shut down the phishing sites.
**4.0 Mitigation**
> 4.1 If you do receive such emails, which look like it came from LHDN or banks itself, you can:
>
> - Contact the LHDN and the banks for clarification and verification.
> - Forward the phishing email to [[email protected]](/cdn-cgi/l/email-protection#beddc7dcdbcc878787feddc7dcdbcccddbddcbccd7cac790d3c7) MyCERT/CyberSecurity Malaysia for our necessary action to handle the incident.
> - Forward to MyCERT the full email header of the email which you received purportedly from LHDN
> - Delete or ignore and never respond to such emails.
>
> If you are a victim:
>
> - Notify the respective bank and get their advise or assistance on this matter.
>
> 4.2 If you use the Firefox browser, please consider using our anti-phishing plugin, 'DontPhisme' for detecting phishing sites. Please visit the following URL for more information on the plugin:
> <https://addons.mozilla.org/en-US/firefox/addon/142878/>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#d7b4aeb5b2a5eeeeee97b4aeb5b2a5a4b2b4a2a5bea3aef9baae) or [[email protected]](/cdn-cgi/l/email-protection#7a1703191f080e3a1703191f080e5415081d541703)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
[1]  Official Statement from LHDN:
<http://www.hasil.gov.my/pdf/pdfam/KENYATAAN_MEDIA_PENAFIAN_EMEL_BAYARAN_BALIK.pdf>
[2]  MyCERT Alert - Phishing Attempts by Impersonating Email from Lembaga Hasil Dalam Negeri (LHDN):
<https://www.mycert.org.my/portal/advisory?id=MA-241.072010>