Exposed: The Viral C&K Steel Company Phishing Email Scam

In today’s digital age, email scams are becoming more and more common. One such scam that has been circulating recently is the “C&K STEEL COMPANY” email scam. This fraudulent email is designed to look like a legitimate business inquiry but contains malicious attachments that can infect your device if opened.

This article will provide an in-depth overview of how the C&K STEEL COMPANY scam works, how to identify it, the malicious attachments it contains, the risks of infection, and most importantly, what you should do if you receive this email or have fallen victim to this scam. With online threats continually evolving, awareness and education are key to protecting yourself.

Scam Overview

The C&K STEEL COMPANY scam email is presented as an inquiry about purchasing metals or steel products from the recipient’s company. The message will contain some variation of the following:

Dear Sir,

I am Phil Lambert, Sales Manager from C&K STEEL COMPANY.

Our customer is in urgent need of your products as seen on your website.

Please find attached our inquiry on METALS for your reference.

Kindly quote your best prices with date of delivery.

Thanks and Best Regards,

Phil Lambert

C&K STEEL COMPANY

This email is designed to look like a legitimate prospective customer reaching out for a quote. However, C&K STEEL COMPANY does not actually exist. The email address will use a domain that is designed to imitate a real steel company. The message is short and vague, with an attachment that supposedly contains more order details.

If the recipient opens the attached document, their computer will become infected with malware. The malware payload can include spyware, adware, ransomware, cryptojacking software, or other threats. The attackers then gain access to the victim’s system for monetary gain or to steal sensitive data.

Some signs that this is a scam:

• Generic greeting like “Dear Sir” instead of using your name or company
• Poor grammar and spelling errors
• Attachment with a generic name like “Inquiry.zip”
• Sender email does not match legitimate domain
• Requests urgent action but provides few details

This scam takes advantage of people’s willingness to open attachments from what appears to be a prospective customer. But the attachment contains nothing useful and will only lead to the victim’s device becoming infected.

Anatomy of the Scam Email

Let’s break down the components of what makes this a scam:

The Sender

The email purports to be from someone named Phil Lambert, a Sales Manager at C&K STEEL COMPANY. However, research indicates no legitimate steel company exists by this name. The sender email will use a domain name meant to imitate a real steel or manufacturing company.

The Content

The body of the email is vague, containing no specific details about what steel products are needed or in what quantities. This is meant to get the recipient to open the attachment for more information. There is an urgency implied about fulfilling a customer order, to compel quick action.

The Attachment

The referenced attachment is usually named something generic like “Inquiry.zip.” Its sole purpose is to deliver malware to infect the victim’s system. The zip file likely contains an executable file that installs the malware when opened. The malware can then compromise the system and give the attackers remote access.

The Motive

The end goal is to infect as many computer systems as possible and gain access either to steal sensitive data or install malware that generates revenue for the attackers. The malware may steal login credentials, financial information, or encrypt files for ransom (ransomware). Or it may turn the computer into a cryptomining bot or force it to display unwanted ads (adware).

How the Scam Works

Now let’s look at the detailed stages of how the C&K STEEL COMPANY scam unfolds:

1. You Receive the Email

The scam email arrives in your inbox just like any other business inquiry. The subject “STEEL INQUIRY” is vague enough that most recipients would open the email to see what it’s regarding.

When you open it, the message appears to be an inquiry about purchasing steel products from your company. The sender identifies themselves as Phil Lambert, Sales Manager for C&K STEEL COMPANY.

There are no other specifics provided in the brief email message. You are directed to open the attached document for more details about the supposed order.

2. You Open the Malicious Attachment

Wanting more information, you proceed to open the attached ZIP file, named something like “Inquiry.zip.”

Inside is usually an executable file, but could also be a PDF, Word doc, or other file format. Opening this attachment triggers the infection chain.

Some signs that the attachment is malicious:

• Generic name like “Inquiry.zip” rather than a descriptive name
• Contains an executable (.exe) or unexpected file type inside
• Originates from an email with vague details

3. Infection Chain Initiated

By opening the attachment, you have activated the malware payload. This begins a series of events designed to infect your computer and grant the attackers remote access.

The infection chain may involve:

• Executable file running and installing malware/viruses
• Exploit kits unleashing zero-day attacks
• Downloading additional payloads from external sites
• Modifying system settings to disable security
• Connecting to command and control servers

You may not notice anything immediately. The malware runs silently in the background, taking over crucial system processes and settings.

4. Payload Effects Take Hold

Once the malware is firmly entrenched in the system, the damaging effects of the payload become apparent. Possible consequences include:

• Loss of sensitive data like credit cards, passwords, etc.
• Ransomware encrypting files and demanding payment
• System resources consumed for cryptojacking
• PC rendered unstable, crashes frequently
• Personal information theft leading to identity fraud
• Adware bombarding you with pop-ups
• Computer added to botnet for future attacks

The attackers now have remote access to spy on activity, steal data, or leverage the infected computer’s resources for their own financial gain.

5. Attackers Achieve Their Goals

The malware payload continues communicating with command servers to send stolen data or await further instructions.

With information and access harvested from thousands of infected computers, the attackers may:

• Sell stolen personal and financial data on the dark web
• Use banking credentials to commit fraud or launder money
• Hold files for ransom from ransomware victims
• Use botnets to mine cryptocurrency or conduct denial-of-service attacks
• Continually develop viruses to attack more targets

For you, the victim, the costs can include lost data, stolen identities, unauthorized bank transactions, and an unstable or unusable computer.

How to Identify This Scam

Here are some tips for identifying and avoiding this scam:

• Scrutinize sender email addresses for legitimacy
• Watch for generic greetings and poor grammar
• Verify company names aren’t associated with other scams
• Check message headers and domain registrars
• Hovers over hyperlinks to inspect destinations
• Open attachments only from trusted sources
• Scan attachments with antivirus software first
• Enable macros cautiously or not at all
• Keep software patched and updated
• Use email filters to block dangerous extensions

With vigilance and awareness, you can hopefully prevent infection and avoid becoming a victim.

What to Do if You Have Fallen Victim

If you have unfortunately been tricked by the C&K STEEL COMPANY scam, here are some important steps to take right away:

1. Disconnect from Networks

Immediately disconnect the infected computer from any network it’s on. Unplug from wired connections and disable Wi-Fi. This stops the malware from spreading or communicating further.

2. Run Anti-Malware Scans

Run full virus scans using updated security software from vendors like Malwarebytes and ESET. Quarantine or delete anything suspicious found. This may eliminate some of the infection.

3. Change Passwords

Assume your credentials have been compromised. Change passwords on email, banking, social media, and other sensitive accounts. Make them long and complex. Enable two-factor authentication wherever possible.

4. Contact Banks and Credit Bureaus

If banking information or accounts may have been accessed, contact your bank to report unauthorized activity and have fraudulent charges reversed. Also reach out to credit bureaus to monitor for identity theft.

5. Wipe Hard Drive and Reinstall OS

The most thorough way to disinfect is wiping the hard drive completely and reinstalling the operating system. Backup important data externally first. This essentially resets the computer to a clean state.

6. Inform Contacts

Alert business contacts that they may have received malware from your compromised email account. Warn friends about potential phishing attempts using your info.

7. Monitor Accounts Closely

Carefully scrutinize financial statements, credit reports, and account activity for any suspicious transactions for the next several months. Report anything abnormal to authorities. Signs of identity theft can take time to manifest.

8. Bring in Expert Help

For major infections, bring the computer to IT security professionals for analysis and data recovery. If identity theft occurs, engage lawyers to ensure rights and protections. Law enforcement may need to get involved.

9. Learn from the Experience

In the aftermath, learn how to strengthen security and be more alert to warning signs of phishing scams. Educate yourself on malware risks and prevention best practices. Be especially cautious when opening email attachments going forward.

With prompt action, malware infections can hopefully be contained and not lead to lasting damage. But it’s still crucial to have a plan in case you accidentally open a malicious attachment in a convincing scam email.

Is Your Device Infected? Check for Malware

If your device is running slowly or acting suspicious, it may be infected with malware. Malwarebytes Anti-Malware Free is a great option for scanning your device and detecting potential malware or viruses. The free version can efficiently check for and remove many common infections.  

Malwarebytes can run on Windows, Mac, and Android devices. Depending on which operating system is installed on the device you’re trying to run a Malwarebytes scan, please click on the tab below and follow the displayed steps.

Frequently Asked Questions

What is the C&K STEEL COMPANY email scam?

This is a phishing scam where victims receive an email pretending to be an inquiry from C&K STEEL COMPANY. The email contains a malicious attachment that infects the recipient’s computer with malware if opened.

How does the scam email work?

The email is made to look like a business customer is requesting a quote for a steel order. It asks the recipient to open the attached document for more details. The attachment is malware disguised as a Word doc, PDF, executable file, etc.

What happens if I open the attachment?

Opening the attachment enables malware to silently install on your computer. This gives attackers remote access to steal data, install more malware, or otherwise compromise the infected system.

What types of malware might it install?

Possible malware payloads include spyware, ransomware, trojans, viruses, cryptojacking scripts, adware, and more. The malware can also make your computer part of a botnet.

What are the risks if my computer is infected?

Risks include identity theft, bank fraud, stolen passwords, encrypted files held ransom, hardware damage, and unauthorized use of your computer resources.

How can I identify this scam email?

Look for vague messages from unknown senders, spoofed email addresses, suspicious attachments like “Inquiry.zip”, typos, and urgency to open attachments right away.

What should I do if I open the attachment?

Immediately disconnect your computer from networks, run anti-malware scans, change account passwords, check for fraudulent activity, and consider wiping your hard drive to reinstall the OS.

Should I report this scam or attachment? Who to?

Yes, report the phishing scam to your email provider and relevant cybersecurity authorities. You can also report the attachment to your antivirus vendor.

How can I protect myself from this scam in the future?

Be wary of all unsolicited attachments, verify sender addresses, hover over hyperlinks to inspect destinations, use antivirus software, keep software updated, and avoid enabling macros.

What should businesses do to avoid this scam?

Educate employees on phishing techniques, implement email security filters, require two-factor authentication, use endpoint detection tools, develop incident response plans, and keep backups current.

Conclusion

The C&K STEEL COMPANY scam email highlights the ongoing threat that social engineering and malware attacks pose in today’s interconnected world. While this scam takes the form of posing as a customer inquiry, phishing emails use many guises to fool victims into infecting their own devices.

Being aware of the tactics and techniques used in these scams is key to recognizing and avoiding them. Indicators like poor grammar, urgent requests for action, and dubious attachments from unknown senders should all raise red flags. Never open attachments unless you can verify the source as legitimate first.

If you unfortunately do fall victim and a device becomes infected, have a response plan ready to limit damage. Quickly disconnect from networks, run anti-malware scans, change account credentials, monitor for identity theft, and contact authorities for assistance as needed.

With vigilance and education, individuals and businesses can stay several steps ahead of constantly adapting cybercriminal schemes. Always err on the side of caution when assessing emails, especially those containing attachments. A bit of added scrutiny and skepticism can go a long way in protecting yourself and your data.