ALERT: Don’t Open “Await Your Approval” Emails – It’s a Trap

Email scams are on the rise, with criminals using increasingly sophisticated techniques to trick unsuspecting victims. One such scam that has emerged recently is the “Await Your Approval” email scam. This fraudulent email claims you need to approve an attached document, but it’s a trap – opening the attachment infects your computer with dangerous malware.

In this comprehensive guide, we’ll explain everything you need to know about this scam, including how it works, what to do if you’re targeted, and how to protect yourself. With online threats continually evolving, awareness and education are your best defenses.

Overview of the “Await Your Approval” Scam

The “Await Your Approval” scam starts with an email appearing to come from an individual, often using a Gmail or other public email address. The subject line contains some variation of “Await Your Approval” along with a filename resembling a legitimate document.

Here’s an example:

Subject: Await Your Approval - Completed [3046854-ber3.docx]

Dear Sir/Madam, 

Please review the attached document. Let me know once approved.

Thank you,
[Sender Name]

If you receive an email like this do not open the attachment. It contains malware that will infect your device. This scam has two main goals:

• Infect your computer with ransomware, which encrypts your files until you pay the criminals.
• Infiltrate your computer with information-stealing trojans to gain access to passwords, financial accounts, and other sensitive data.

This scam is essentially a phishing attack – social engineering designed to trick you into downloading malware onto your own computer. The criminals rely on the appearance of authority and urgency to get your guard down.

How the “Await Your Approval” Scam Works

The operation behind this scam is sophisticated, maximizing the chances victims will open the malicious attachment. Here’s a step-by-step look at how it works:

1. Criminals Obtain Email Addresses

The scammers likely purchased stolen email addresses on the dark web, compiling a large list of potential targets. They may also use email harvesting techniques to gather addresses from websites and public directories.

2. Malware is Prepared

The criminals have stockpiles of malware, including ransomware and remote access trojans. The malware is bundled into email attachments, often using decoy filenames like agreements, invoices, or other documents victims might reasonably expect to receive.

3. Spoofed Emails are Sent En Masse

Using the purchased email lists, the scammers send massive volumes of emails with the fake attachment. The “From” address is spoofed so the email appears to come from an individual’s public email or a colleague.

4. Social Engineering Tactics Pressure Recipients

The email is short but exploits psychological tactics to get recipients to open the attachment. The false sense of authority and claim you must review the document creates urgency. The limited details provide few red flags.

5. Victims Open the Malicious Attachment

If the social engineering is successful, recipients will open the attached document, falsely believing it is a work-related file needing approval. This launches the malware installation on the victim’s device.

6. Criminals Achieve Their Aims

Once installed, the malware will either encrypt files for ransom or covertly steal data and compromise accounts. The hackers will continually exploit the access until the malware is detected and removed.

This sequence allows criminals to infect thousands of computers rapidly with very little effort. Even low success rates still provide profitable results at this scale.

What to Do If You’re Targeted by the Scam

If you receive an “Await Your Approval” email or any other suspicious message with an attachment, take the following actions:

Do Not Open the Attachment

This is critical. The attachment contains the malware payload so never open it. Also avoid clicking any links as they may download malware directly.

Check the Sender’s Address

Even if the “From” name looks legitimate, check the actual email address which often exposes spoofing.Hover your cursor over the name without clicking to view the address.

Delete the Email

Once identified as a scam, delete the email immediately. You may also report the email as phishing/spam within your email client. This helps protect others.

Run a Malware Scan

Run a full system scan using updated security software to check for any malware that might have slipped through. Ransomware and trojans may already be lurking if you had opened past suspicious attachments.

Change Passwords and Enable Two-Factor Authentication

If infected, hackers may have access to your passwords and accounts. Change all passwords and enable two-factor authentication wherever possible to secure accounts.

Monitor for Suspicious Activity

Carefully monitor bank accounts, credit cards, and other sources of sensitive data for any unauthorized access in the weeks following infection. Report any suspected fraud or theft immediately.

Staying vigilant following an attempted scam attack allows you to contain the damage and prevent further issues down the road.

How to Protect Yourself from the Scam

Beyond the specific actions to take if targeted, there are steps everyone should implement to avoid becoming a victim of the “Await Your Approval” scam:

Be Wary of Any Unexpected Attachments

Never open an attachment from someone you don’t know, and be cautious even with those from known contacts – verify first.

Verify the Sender Before Taking Action

Call or speak to the supposed sender first before opening attachments or links to confirm legitimacy.

Use Antivirus/Antimalware Software

Maintain real-time scanning and auto updates on your computer using security software from trustworthy vendors. This instantly catches most malware.

Back Up Your Files

Routine backups to disconnected media prevent ransomware from holding your data hostage. You can restore files rather than paying ransom.

Disable macros in Office Files

Microsoft Office files can contain potentially malicious macros.Disable macros to neuter this threat vector.

Keep Software Updated

Hackers exploit unpatched vulnerabilities in outdated apps. Staying updated closes holes in your digital defenses.

Think Before Clicking

No urgency in an email justifies rushing into opening an attachment. Take time to scrutinize requests and confirm legitimacy first.

Use DMARC Email Authentication

DMARC verifies the actual sending domain for emails and can expose spoofing. Work with your email provider to implement it.

Staying vigilant to online threats is the new normal everyone must adopt. Following best practices guards against the latest scams, keeping your data and devices protected.

Is Your Device Infected? Check for Malware

If your device is running slowly or acting suspicious, it may be infected with malware. Malwarebytes Anti-Malware Free is a great option for scanning your device and detecting potential malware or viruses. The free version can efficiently check for and remove many common infections.  

Malwarebytes can run on Windows, Mac, and Android devices. Depending on which operating system is installed on the device you’re trying to run a Malwarebytes scan, please click on the tab below and follow the displayed steps.

Frequently Asked Questions About the “Await Your Approval” Scam

1. What is the “Await Your Approval” scam?

The “Await Your Approval” scam is a phishing campaign where victims receive an email claiming they need to review and approve an attached document. The attachment actually contains malware, like ransomware or info-stealing trojans, which infects the victim’s computer when opened.

2. What does the scam email look like?

The scam email has a subject line like “Await Your Approval – Completed [file number]”. The body claims you need to review an attached document and “approve” it. The attachment has a spoofed filename resembling a legitimate document.

3. Who is sending the “Await Your Approval” scam emails?

The emails are from cybercriminals who crafted the phishing campaign to distribute malware. The sender name and email address are often spoofed to appear like a colleague or legitimate contact tricking victims.

4. How does the malware in the attachments infect my computer?

Once you open the attachment, it launches a malware installation sequence. This drops malware files onto your computer and system registry, infecting the device. Ransomware will encrypt files, while trojans steal data.

5. What types of malware are used in the scam?

Two main types of malware have been seen in the scam: ransomware, which encrypts your files until a ransom is paid, and remote access trojans, which stealthily infiltrate your computer to steal passwords, financial account details, and other sensitive data.

6. What happens if my computer gets infected by the malware?

You’ll likely lose access to your files if infected with ransomware. The criminals will demand payment in cryptocurrency to decrypt the data. Trojans will secretively compromise accounts and steal data, money, and identities.

7. What should I do if I receive an “Await Your Approval” email?

Do not open the attachment or click any links. Check that the actual sender email address is legitimate. Delete the email and run malware scans to check for existing infections. Change passwords and enable two-factor authentication on accounts as a precaution.

8. How can I protect myself from this scam in the future?

Never open attachments from unknown senders. Verify legitimacy before opening files even from known contacts. Use updated antivirus software. Back up files routinely. Disable Office macros. Keep all software updated. Use DMARC authentication to uncover spoofed emails.

9. What should I do if I already opened the attachment and got infected?

Immediately disconnect your computer from any networks to prevent spreading. Scan with antivirus software to attempt removal. You may need professional assistance if scans fail. Check accounts for unauthorized access and report any signs of stolen data or identity theft.

10. Who can I contact for help if my device is infected?

Reach out to a computer technician or your device manufacturer for malware removal help. Notify your contacts of potential file exposure. Report identity theft to the FTC. File a complaint about the scam email with the FBI’s Internet Crime Complaint Center.

Staying vigilant against online threats and following cybersecurity best practices is the most effective way to avoid complex malware attacks through phishing emails promising a payment, tax refund, or that you have to “approve” a document. When in doubt, pick up the phone and verify things directly with your contact before clicking on links or attachments in unsolicited emails.

The Bottom Line

The “Await Your Approval” scam is a dangerous form of malware distribution that exploits a sense of urgency and authority to trick recipients. If targeted, do not open the attachment under any circumstances. Carefully check the actual sender address, delete the email, and run scans to uncover existing infections.

Moving forward, implementing ongoing precautions like updated security software, backups, macro disabling, and DMARC authentication will significantly improve your protection against email-based threats. Stay alert to suspicious messages, think before clicking, and verify requests to avoid becoming the next victim. Your cyber-security is ultimately in your own hands.