# MA-640.102016: MyCERT Alert - Phishing Emails Targeting Bank Negara Malaysia (BNM)

**Date:** 14 Oct 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-640.102016  
**Advisory ID:** MA-640.102016

---

**1.0 Introduction**
MyCERT has been receiving several incidents from Internet users who are receiving fraudulent emails purportedly from Bank Negara Malaysia.
The fraudulent email works by luring the victim into believing that they have an incoming payment to their account.
The inexperienced and untrained victim on security awareness may believe the fraudulent email and may click on the link attached in the email.
**2.0 Impact**
- Huge loss of money to victims
- Identity theft as confidential details of victim is stolen and used for other malicious activities
**3.0 Sample Fraudulent Email:**
The below are same sample emails that potential victims may receive. Users are advised to be vigilant of such emails and refrain from responding to them.
*Figure 1: The email content of this phishing attackFigure 2: The phishing email with "BNMNOTICE.pdf" as attachmentFigure 3: The phishing email with "BNM\_CREDIT.pdf" as attachment*
The attachment included with the email is a PDF file as per below screenshot:
*Figure 4: Example screenshot of the opened attachment*
Once clicked on the file attached in the phishing email, it will open up a PDF document. Within the PDF file, there are some messages and hyperlink "Click Here" as shown in Figure 4. Phishing sites sample are as per below:
*Figure 5: Example screenshot of the BNM phishing websiteFigure 6: A screenshot of the BNM phishing website's login textboxes*
Below is another example for the phishing website (URL: http://www.albasolar.es/dmdocuments/3fSrdMY7zYEvLQLhEx3PCHeQ/)
Figure 7: Another screenshot of the BNM phishing website's login textboxes.
Based on our analysis, below are the phishing URLs involved in this attack:
- http://ahvc-naturopath.com.au/RdShTeVwh7WYpHUyXPPyTkAx/
- http://ahvc-naturopath.com.au/wp-content/plugins/xzAUA3dv5Ng7JhhxG3VXfAJE/
- http://ahvc-naturopath.com.au/wp-includes/pomo/JaVBsAjL47gb4Zw3YGgWxeDv/
- http://ahvc-naturopath.com.au/wp-includes/pomo/JaVBsAjL47gb4Zw3YGgWxeDv/2c7295bc272f8191ba842f5c2236b816/
- http://ahvc-naturopath.com.au/wp-includes/pomo/JaVBsAjL47gb4Zw3YGgWxeDv/58911ca38fe269b2b7231b6977168883
- http://ahvc-naturopath.com.au/wp-includes/theme-compat/5zLXyNSL2R7Mr452c
- http://ahvc-naturopath.com.au/wp-includes/theme-compat/5zLXyNSL2R7Mr452cSvQVBa8/
- http://www.albasolar.es/dmdocuments/3fSrdMY7zYEvLQLhEx3PCHeQ/
- http://darlinlildresses.com/includes/kVHQ7MqUtDt5JJCaTg6CpsPP/
- http://nexgentruckrepair.com/wp-content/plugins/
- http://nova4u.com/meps/K8XzAnSfBC3sWBpRWPpXk4CY/configure/
- http://ww1.banknegara.com/
- http://banknegara2u.com/
- http://reports.banknegara2u.com/
**4.0 Recommendation**
4.1 If you do receive such emails, purportedly from BNM, you can:
- Contact BNM and the banks for clarification and verification.
- Forward the phishing email to [[email protected]](/cdn-cgi/l/email-protection) MyCERT/CyberSecurity Malaysia for our necessary action to handle the incident. Forward to Cyber999 the full email header of the email which you received purportedly from BNM for our analysis purpose.
- Delete or ignore and never respond to such emails.
4.2 If you are a victim:
Notify the respective bank and get their advise or assistance on this matter.
4.3 If you use the Firefox browser, please consider using our anti-phishing plugin, 'DontPhishme' for detecting phishing sites. Please visit the following URL for more information on the plugin:
- <https://addons.mozilla.org/en-US/firefox/addon/142878/>
Generally, MyCERT advises the users and administrators to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)