Fake Orange invoices spread Remcos RAT trojan, CERT warns

In this campaign, criminals set the sender's display name to look identical to genuine mail, while the actual email address had nothing to do with Orange. The display name field can contain any text. In an earlier variant of the attack, fraudsters even typed "e-faktura@pl.orange.com" into that field to lull recipients.

What to check

In a real message, the recipient field shows the customer's own address (some mail clients display it as "to me"). In fake emails the "To" field can look odd: it may contain faulty headers, be empty, or suggest that the same message went to many people at once.

Another control point is the "Security rules" section. An authentic email should include the recipient's details or company name and a customer number. CERT described a case where the message contained data of a real company that uses Orange services, yet the email reached a completely different person.

Both genuine and fake messages may carry an attachment, but its purpose differs: the real one is an invoice, the fake one a file meant to install Remcos RAT. According to CERT, criminals may have copied the template from the internet or obtained it after taking over a company mailbox and its correspondence.

What to do

Specialists advise extra caution with any payment-related message and recommend watching for unusual details. The safest way to pay an Orange invoice is through the Mój Orange app or directly in your banking app, by repeating an earlier payment. Suspicious emails can be forwarded for verification to cert.opl@orange.com.