Sponsored by..

Friday, 6 January 2012

"Elavon 2012 Update" phish

Elavon deals with payment processing. This email is not from Evalon.

From: "Elavon, Inc." [sobolan@myvirtualmerchan-02.com]
Date:Fri, 06 Jan 2012 16:09:48 +0100
Subject: Urgent-Notification

--Elavon 2012 Update--
Dear Customer,

We regret to inform you that your retail merchant account is locked.
To re-activate it please download the file attached to this e-mail and update your login information.

2012 Elavon Inc,
-Please note only RETAIL account are locked-
-Example : Market Segmet : Retail-

Attached is a file called myvirtualmerchant_login.html which is the phish itself, displaying the following screen.

The form itself sends the details to mail.xinsanjing.com on (HangZhou XinSanJing Food Co. Ltd. China) which is possibly a hacked server. In this case the email originated from in Puerto Rico.

If you use Elavon's services, watch out for this phish.


Eisley Jacobs said...

Thanks for this information. I just googled this after receiving an email and found your blog. I don't even use Elavon, so I knew it was a phish, but at the same time I thought, maybe I signed up?! Thanks!

blively6 said...

I just received this same email today. I googled and read your blog too. Thank you for providing this information.