Filed under: Tips and tricks, Odds and ends, Internet
New Fake .Mac Email
I just received this at my .Mac account:Dear user [MY USER NAME],
You have successfully updated the password of your Mac account.
If you did not authorize this change or if you need assistance with your account, please contact Mac customer service at: support@mac.com
Thank you for using Mac! The Mac Support Team
+++ Attachment: No Virus (Clean) +++ Mac Antivirus - www.mac.com
Heh. Mac Antivirus? Anybody else received these?
UPDATE: By the way, if you receive something like this and you aren't sure if it is a fake, assuming you are using Mail.app, go to View—>Message—>Raw Source. Grab a couple of the IP addresses in the header and run a Whois on them, or simply scan for them in Google. Most likely, it'll show up as not being Apple, and as being a known spammer. Train your spam filter to recognize it as spam and delete.
![TUAW [Cafepress]](http://www.blogsmithmedia.com/www.tuaw.com/media/tuaw-cafepress-promo.png)
Reader Comments (Page 1 of 1)
ericd said 9:06PM on 6-23-2005
i get these all the time to my reg. account (same kind of footer), but I have never gotten one of them @ my .mac account. I don't use that account for much to try and keep it as clean as possible,
Reply
Random said 9:06PM on 6-23-2005
Mmmm, phish. Well, not quite. I doubt I have to warn you about opening strange zip files. :)
This is one of the many variants of the MyTOB virus. Thank your Windows using pals for it.
Take a look at the sig. Thank you for using Mac! The Mac Support Team? Wouldn't you think the .Mac (dot Mac) support team would know better about including periods before their own product name?
Just an automator throwing the domain of your email addy in the blanks.
Reply
Russell Gordon said 9:18PM on 6-23-2005
Forward the message (showing full source headers -- Cmd-Shift-H) to:
spam@mac.com
This will help the *real* dotMac support team filter this junk out of our inboxes.
Reply
Tim Dorr said 9:40PM on 6-23-2005
This is an email sent by a virus. It's not .Mac-specific. It's actually using the domain that your email address is to figure out who to send to. My timdorr.com address gets ones like these a lot. It's funny to see "Thank you for using Timdorr! The Timdorr Support Team" :D
Reply
byron said 8:43AM on 6-24-2005
I got the same email on my Verizon account. I called them and they said it was a fake. Delete it! Good luck
Reply
Frank Bisono said 1:18AM on 6-24-2005
My buddy got the same email and sent it to Apple. Apple informed him that it was indeed a fake and contained a WINDOWZ virus. The author was apparently too stupid to realize his virus wouldn't harm a Mac. The beauty is we are still immune to this junk...when will the PC heathens get a clue? :-)
Reply
Elise said 11:56PM on 6-23-2005
I've been getting the same thing at my domain - elise.com. "Thank you from the Elise Support Team". Several a day actually in just the last couple of weeks. What a pain.
Reply
CyBeR said 1:43AM on 6-24-2005
And to be complete, all apple.com IP addresses start with 17 and vice versa (all IP addresses that start with 17 belong to Apple.)
Reply
Paul said 2:28AM on 6-24-2005
i laugh when i get emails from the tyrannous.net support team, and the tyrannous.net admin.
Reply
Collin said 3:57AM on 6-24-2005
Like #5's friend, I got one of these emails, but it had a Windows executable attached. I'm not sure what they expected a Mac user to do with a Windows virus.
Reply
Al said 7:31AM on 6-24-2005
You're actually a bit slow to get this, these started showing up in the wild (at least in my tech area) around a month ago.
We got some frantic helpdesk calls from that one.
Reply
Justin said 9:00AM on 6-24-2005
Oh you guys. Google is your friend. It's a new strain of Mytob that popped up last week. I'm a lifelong Apple user but it still surprises me how technically illiterate a lot of Mac users are... "New fake .Mac e-mail"? I mean, come on...
Reply
Paul Bernicchi said 10:51AM on 6-25-2005
If the password was changed for your .Mac account, and you didn't change your password in Mail.app (assuming you don't forward to a POP3 acct), wouldn't it raise a flag or two to receive this notice? In this example, the two passwords (server/client) wouldn't match.
Reply
Judi Sohn said 5:28AM on 6-27-2005
This is not new. I first started getting mail from "the Momathome Team" over a year ago. Blogged about it at the time: http://www.momathome.com/viewfromhome/2004/03/best_wishes_fro.php As noted, it's a virus. The exact strain has changed, and the text of the email has varied a bit but it's essentially the same thing...trick the victim into thinking their ISP/email administrator sent the message so they'll follow the instructions. I support a number of domains and I'm getting a lot of "Did you send me this?" email from my clients who are smart enough to ask me first before clicking on the attachment. The virus doesn't know or care that you're on a Mac. All that matters is that you have an email address and that your address was found somewhere on a victim's computer.
Reply