New kind of phising. Got my friends name in spoofed mail

[northernladuk]

My other half said she got a mail from one of our shared friends. Lets call her Bob Smith. The mail is from Bob Smith but when you check the email it's spoofed. Title of mail is 'fwd: (2 photos) - Bob Smith'

Content is a line saying we are ready with standard crap URL.

Missus gets all sorts of rubbish but was surprised to see I got the same email today, from Bob Smith. So a new level of weird as the spammer knows we are both friends and has our emails.

Where could they have got this from? Can't be FB because it knows our emails, can't from a mobile app? As much as I just shrug because it's scammers upping their game it's odd that it as our emails and who we are friends with? Is the data leak at Bob Smiths end and they got our emails from her?

[jamesbrown]

Pretty standard phishing, I would’ve thought. If their email were compromised, it wouldn’t have been spoofed, and that is the normal patter. Probably compromised an address book or something. Have a word with Bob.

[Snarf]

There's a chance its a coincidence, I got a phishing email reporting to be from my dad once but then got exactly the same email to the same account with a different name signing it off.

Could also be that Bob had their contacts leaked and its a really weak attempt at spearphishing.

I'd just delete it and move on - maybe tell Bob just in case.

[hobnob]

When you say "spoofed", do you mean that the email address didn't match, or that the address was correct but it failed SPF/DKIM checks?

One possibility is that you and Bob were both sent the same email. E.g. if Alice sent a "Merry Christmas" email to all her friends and family, but did cc rather than bcc, so all the recipients got each other's addresses.

[PerfectStorm]

One of the oldest types of phishing, technology professionals have commonly seen this going back 15 years or more.

Typically one of the affected would reveal their email address book in the usual way and the scammers work out from there.

[quackhandle]

What did your accountant say?

qh