Insoorya Express Cargo Email Virus: The Excel File That Can Infect Your PC

An email about damaged cargo documents may look like routine freight paperwork. In this campaign, however, the attached spreadsheet is the danger: clicking Enable Editing can let hidden commands run on the computer.

The message impersonates Insoorya Express Cargo, but the legitimate freight company has nothing to do with it. This is a confirmed malware-delivery email, and the safest response is to delete it without opening the Excel file.

Overview

The Insoorya Express Cargo email virus is a targeted-looking malspam campaign built around a fake shipment conversation. Rather than announcing a lottery win or making an obviously strange request, the message imitates the language used by freight forwarders, importers and purchasing teams.

The email refers to shipment documents connected to PO/RFQ RFQ10930. It claims that an air waybill, packing list, certificate of conformity, invoice and other paperwork have been updated. The sender may even ask whether a colleague received earlier documents, creating the impression that the recipient has joined an existing business thread.

Its attachment is named Updated Shipping Documents.xls. The spreadsheet opens in Microsoft Excel’s Protected View, which is a safety feature. The attack only advances when the recipient follows the prompt to enable editing. That action can release hidden macro or exploit-driven commands embedded in the document.

The exact malware installed by this campaign is not reliably identified. That uncertainty does not make the file less dangerous. An unknown payload can be changed between deliveries and may act as a password stealer, remote-access tool, downloader or ransomware installer.

The email subject seen in this campaign is unusually detailed: RE: RE: DAMAGED/ CORRECTED, AMENDMENT EFFECTED in shipment Docs_PO#RFQ10930. The repeated reply markers and specific reference number are social-engineering props. They do not prove that a real conversation occurred.

• Impersonates a real freight-forwarding business without its involvement
• Uses shipment terminology and a purchase reference to appear relevant
• Delivers a legacy .xls spreadsheet rather than ordinary view-only paperwork
• Depends on the recipient overriding Excel’s Protected View warning
• Can install a changing or unknown malware payload after editing is enabled

Is the Insoorya Express Cargo Email Real?

No. The email carrying Updated Shipping Documents.xls is malicious. Insoorya Express Cargo is a legitimate freight company, but criminals are borrowing its name and business details to make the message look credible.

A real company name, address, signature or employee name can be copied from a public website. What matters is whether the sender’s domain, shipment reference and attachment can be verified through a trusted channel you already use.

How the Insoorya Express Cargo Email Virus Works

Step 1: The attacker builds a believable cargo story

The message uses freight language such as AWB, packing list and certificate of conformity. It may mention damaged or corrected documents so the request feels urgent but still ordinary to someone handling imports, purchasing or warehouse operations.

Step 2: The email pretends to continue an earlier conversation

Repeated RE: markers and the RFQ10930 reference make the email appear to be part of an established thread. The recipient may respond quickly because it looks as if coworkers are already waiting for confirmation.

Step 3: The recipient opens the spreadsheet

The attachment looks like paperwork, but it is an old-style Excel workbook capable of carrying active content. Opening it may show a blank, blurred or incomplete sheet along with a yellow Protected View banner.

Step 4: The document asks for Enable Editing

This is the critical moment. Protected View limits what an Internet-downloaded file can do. The attacker needs the recipient to lower that protection, often by implying the document cannot be read until editing is enabled.

Step 5: Hidden commands execute

Once editing is enabled, embedded code or an exploit chain can launch without another obvious confirmation. It may contact an attacker-controlled server, download additional files, create persistence or collect data from the infected Windows account.

Step 6: The compromise expands

A successful infection can expose saved browser passwords, email sessions, company documents and network credentials. If the machine belongs to a business, attackers may also use the mailbox to send convincing follow-up messages to coworkers, customers and suppliers.

Warning Signs in the Fake Shipment Email

• You were not expecting documents connected to RFQ10930
• The sender address does not match a verified company domain
• The subject uses awkward wording, repeated reply markers and unusual capitalization
• The attachment is an editable .xls file instead of a PDF or secure portal link
• Excel asks you to override Protected View to see the supposed document
• The email pressures you to confirm receipt before you can verify the shipment independently

Do not judge the email only by its logo or signature. Sender names are easy to spoof, and a professional-looking footer can be copied in seconds.

What Happens If You Click Enable Editing?

Enabling editing removes one of Excel’s most important protections for downloaded files. In a malicious workbook, that can allow code to start in the background while the screen still looks like an ordinary spreadsheet.

You may not see a pop-up or a visible installer. A quiet infection can be more useful to criminals because it gives them time to steal credentials, monitor activity or deliver a second-stage payload before the victim realizes anything happened.

What to Do If You Received or Opened the File

If you did not open the attachment

Delete the email, empty the deleted-items folder and report the message to your IT or security team. Do not reply to the sender, because a response confirms that your address is active and monitored.

If you opened it but left Protected View enabled

Close Excel without enabling editing or content, delete the file and run a security scan. Protected View substantially reduces the risk, but scanning is sensible because campaigns can use more than one technique.

If you clicked Enable Editing or Enable Content

1. Disconnect the computer from Wi-Fi or Ethernet to limit further communication
2. Do not sign in to banking, email or company services from the affected device
3. Contact your IT team immediately if this is a work computer
4. From a clean device, change passwords for accounts used on the computer and enable multi-factor authentication
5. Check email forwarding rules, recent sign-ins and active sessions for unauthorized changes
6. Run the full malware-removal procedure below before reconnecting the computer

• STEP 1: Uninstall malicious programs from Windows
• STEP 2: Reset browsers back to default settings
• STEP 3: Use Rkill to terminate suspicious programs
• STEP 4: Use Malwarebytes to remove Trojans and unwanted programs
• STEP 5: Use HitmanPro to remove rootkits and other malware
• STEP 6: Use AdwCleaner to remove malicious browser policies and adware
• STEP 7: Perform a final check with ESET Online Scanner

STEP 1: Uninstall malicious programs from Windows

First, we’ll manually check your computer for unknown or malicious programs. Adware and browser hijackers often have a working uninstall entry — removing them this way takes care of the easy part before we run the scanners.

With the malicious programs removed, you’re ready for the next step in this guide.

STEP 2: Reset browsers back to default settings

In this step, we will remove spam notifications,  malicious extensions, and change to default any settings that might have been changed by malware.
Please note that this method will remove all extensions, toolbars, and other customizations but will leave your bookmarks and favorites intact. For each browser that you have installed on your computer, please click on the browsers tab below and follow the displayed steps to reset that browser.

STEP 3: Use Rkill to terminate suspicious programs

Next, we’ll download and run Rkill to stop any suspicious processes running in the background. This prevents the malware from interfering with the removal tools in the following steps.

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools.

1. Download Rkill.

   You can download RKill to your computer from the below link. When at the download page, click on the Download Now button labeled iExplore.exe. We are downloading a renamed version of Rkill (iExplore.exe) because some malware will not allow processes to run unless they have a certain filename.

   

   RKILL DOWNLOAD LINK
   (The above link will open a new page from where you can download Rkill)

2. Run RKill.

   After downloading, double-click the iExplore.exe icon to kill malicious processes. In most cases, downloaded files are saved to the Downloads folder.
   The program may take some time to search for and end various malware programs.

   

   When it is finished, the black window will close automatically and a log file will open. Do not restart your computer. Proceed to the next step in this guide.

STEP 4: Use Malwarebytes to remove Trojans and unwanted programs

Now we’ll install Malwarebytes and run a full scan to detect and remove infections, adware, and potentially unwanted programs from your computer.

Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan and clean your PC in just a few minutes.

1. Download Malwarebytes

   Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.

   

   DOWNLOAD MALWAREBYTES FOR WINDOWS (FREE)
   
   (The link opens in a new page where your download will start)

2. Install Malwarebytes

   When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   The setup wizard will walk you through a few quick screens:

   • Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.

     

   • Malwarebytes will now install on your device. This usually takes under a minute.

     

   • When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.

     

   • On the final screen, click Open Malwarebytes to launch the program.

     

4. Enable “Scan for Rootkits”

   Before scanning, turn on rootkit detection so Malwarebytes can find even the most hidden threats. Click the Settings gear icon on the left side of the screen.

   

   In the settings menu, find “Scan for rootkits” and click the toggle so it turns blue.

   

   Done? Click “Dashboard” in the left pane to return to the main screen.

5. Start the Scan

   Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.

   

6. Wait for the Scan to Finish

   The scan checks your entire system for browser hijackers and other malicious programs, so it can take several minutes. Feel free to do something else — just check back occasionally to see the progress.

   

7. Quarantine the Detected Threats

   When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.

   

   Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.

   

8. Restart Your Computer

   Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, your PC is clean and you can continue with the next steps in this guide.

   

STEP 5: Use HitmanPro to remove rootkits and other malware

Next, we’ll run a second-opinion scan with HitmanPro to catch Trojans, rootkits, and other malicious programs that may have survived the previous step.

HitmanPro is a second-opinion scanner — it’s designed to catch what your main antivirus might have missed. Instead of relying on a single detection engine, it checks the behavior of files in the locations where malware usually hides. Anything suspicious gets sent to the cloud, where it’s analyzed by two of the best antivirus engines available: Bitdefender and Kaspersky.

Good news: scanning is completely free, with no limits. You only need a license when it’s time to remove what was found — and even then, you can activate a free one-time 30-day trial to clean your PC at no cost. (A full license is $24.95 per year for 1 PC.)

1. Download HitmanPro

   Click the button below to download HitmanPro. Remember — the scan is free, so you have nothing to lose by checking your PC.

   DOWNLOAD HITMANPRO (FREE SCAN)
   (The link opens in a new page where your download will start)

2. Install HitmanPro

   When the download finishes, open your Downloads folder and double-click the file: “hitmanpro.exe” on 32-bit Windows, or “hitmanpro_x64.exe” on 64-bit Windows.

   

   If a User Account Control pop-up asks whether HitmanPro can make changes to your device, click “Yes” to continue.

   

3. Follow the On-Screen Prompts

   On the HitmanPro start screen, click “Next” to begin the system scan. No lengthy setup required — it goes straight to work.

   

   

4. Wait for the Scan to Finish

   HitmanPro will now check your computer for malicious programs. This usually takes just a few minutes thanks to its cloud-based scanning.
   

5. Review the Results and Click “Next”

   When the scan is done, HitmanPro will show you everything it found. Click “Next” to remove the detected threats.

   

6. Click “Activate Free License”

   To remove the malicious files, click the “Activate free license” button. This starts your free 30-day trial — no payment details needed — and unlocks the full cleanup.
   

   When the removal is complete, HitmanPro will show a summary of everything it cleaned. Click Next, then click Reboot if prompted. If there’s no reboot prompt, just click Close — your PC is clean.

STEP 6: Use AdwCleaner to remove malicious browser policies and adware

We’ll now use AdwCleaner to remove malicious browser policies and unwanted browser extensions — the leftovers that keep hijacking your browser settings even after the malware itself is gone.

AdwCleaner is a free on-demand scanner that specializes in adware, browser hijackers, and unwanted toolbars — the exact threats that mainstream antivirus programs often miss. It also includes tools that repair the damage malware leaves behind, like hijacked browser settings and malicious policies. It’s a quick scan that’s well worth running.

1. Download AdwCleaner

   Click the button below to download AdwCleaner — it’s free, portable, and requires no installation.

   

   DOWNLOAD ADWCLEANER (FREE)
   (The link opens in a new page where your download will start)

2. Run AdwCleaner

   Open your Downloads folder and double-click the file named “adwcleaner_x.x.x.exe“. There’s no installation — the program starts right away.
   

   If Windows asks whether you want to allow AdwCleaner to run, click “Yes“. When the license agreement appears, click I agree to continue.

   

3. Enable “Reset Chrome policies”

   This setting removes malicious browser policies — a trick malware uses to lock your browser settings so you can’t change them back. Click “Settings” on the left side of the window, then turn on “Reset Chrome policies“.

   

4. Start the Scan

   Click “Dashboard” on the left side of the window, then click the “Scan” button.

   

5. Wait for the Scan to Finish

   AdwCleaner will now check your computer for adware and other malware. This usually takes only a few minutes — it’s one of the fastest scanners around.

   

6. Quarantine the Detected Threats

   When the scan finishes, AdwCleaner will list everything it found. Click the “Quarantine” button to remove all the malicious items at once.

   

7. Click “Continue” to Finish the Cleanup

   Save any open work first — AdwCleaner needs to close your open programs before it can clean. When you’re ready, click the “Continue” button.
   

   AdwCleaner will now delete all detected malware from your computer. If it asks you to restart your PC, allow it — your computer will be clean when you log back in.

STEP 7: Perform a final check with ESET Online Scanner

Finally, we’ll run ESET Online Scanner as a last sweep to confirm nothing was missed. If this scan comes back clean, your computer is malware-free.

ESET Online Scanner is a free second-opinion scanner that performs a deep, full-system check for viruses, trojans, rootkits, and other malware. We use it as the final step because it’s thorough — if anything slipped past the previous scans, ESET will find it. A clean result here means your computer is malware-free.

1. Download ESET Online Scanner

   Click the button below to download ESET Online Scanner.

   

   DOWNLOAD ESET ONLINE SCANNER (FREE)
   (The link opens in a new page where your download will start)

2. Run the Installer

   When the download finishes, open your Downloads folder and double-click “esetonlinescanner.exe“.
   

3. Install ESET Online Scanner

   On the start screen, select your language from the drop-down menu and click Get started.

   

   On the Terms of use screen, click Accept.
   

   Choose your preferences for the Customer Experience Improvement Program and the Detection feedback system (either choice is fine), then click Continue.
   

4. Start a Full Scan

   Click Full Scan — this checks your entire computer, not just the common hiding spots.

   

   Select Enable for Detection of Potentially Unwanted Applications — this lets ESET catch adware and bundled junk programs, not just viruses. Then click Start scan.

   

5. Wait for the Scan to Finish

   ESET will now check every file on your computer. Because it’s a full scan, this can take a while — often an hour or more, depending on how much data you have. Leave it running in the background and check on it from time to time.

   

6. Review the Results

   When the scan completes, the Found and resolved detections screen appears. Any threats found were automatically cleaned and quarantined — there’s nothing extra you need to do. Click View detailed results if you want to see exactly what was removed.
   

   If ESET found nothing — congratulations, your computer has passed the final check and is malware-free.

How to Protect Your Business From Similar Attachments

• Verify unexpected purchase orders and shipment changes using a known phone number
• Block Internet-delivered Office macros and restrict legacy document formats where possible
• Train staff that Enable Editing is a security decision, not a viewing requirement
• Use email filtering that quarantines macro-enabled and suspicious spreadsheet attachments
• Require multi-factor authentication for email, cloud storage and finance systems
• Keep Windows, Microsoft Office and endpoint security tools fully updated

Frequently Asked Questions

Is simply reading the email dangerous?

Reading the message is not the main danger. The attack depends on the attached spreadsheet and, in particular, on allowing it to run active content.

Is Updated Shipping Documents.xls a real shipment file?

Not in this campaign. The filename is bait. If your organization genuinely expects shipment paperwork, obtain a clean copy through the supplier contact or portal already on record.

Which malware does the spreadsheet install?

The final payload has not been confirmed and may change. Treat the computer as potentially compromised if editing or content was enabled, regardless of whether visible symptoms appeared.

The Bottom Line

The Insoorya Express Cargo message is a confirmed malware-delivery scam hiding behind realistic shipping language. The legitimate company is being impersonated, and the Excel attachment should not be trusted.

If you only remember one rule, make it this: an unexpected spreadsheet should never need you to bypass Protected View. Verify the shipment separately, delete the message and take immediate containment steps if you enabled editing.