Warning – watch out for fake (spam / phishing) emails pretending to be from MYOB

Hi all,

We’ve recently been made aware of two phishing campaigns where emails and SMS are being sent impersonating MYOB invoices!

1) Emails are being sent impersonating MYOB invoices, with the intent of infecting victims with the DanaBot trojan (banking trojan).

While we have not had any direct reports of such emails from our client base, we urge that you read the following links for information on what to look out for:

• https://threatpost.com/danabot-trojan-targets-bank-customers-in-phishing-scam/133994/
• https://www.trustwave.com/Resources/SpiderLabs-Blog/DanaBot-Riding-Fake-MYOB-Invoice-Emails/?page=1&year=0&month=0&LangType=1033

2) SMS sent to MYOB clients with a link of an invoice that is to be paid, where it is hoped the client will enter their userid and password for capture. 

Below is a copy of one such message:

Note:  MYOB does not send SMS with links to invoices for payment.

Tips to protect against fraudulent emails:

• Only open emails from email addresses that you trust. Legitimate invoices from MYOB small business products will only come from accountright@apps.myob.comor noreply@apps.myob.com
• Check that links are valid before clicking on them. Links from genuine MYOB emails to external sites will always start with apps.myob.com.
• Ask yourself if you expected to receive the email.
• Check it against previous emails from the same company. Does the email address, design and style of writing match what you usually receive?
• Use common sense. If you’re not sure, use an external method of communication (such as a phone number from the company’s website) to contact the company that sent the email.

Please follow the tips to protect yourself against fraudulent emails. And if you receive any suspicious emails, please forward a copy to securityteam@myob.com.