Intuit QuickBooks Payment Invoice Email Scam Installs Malware on Windows

A surprise QuickBooks receipt says a $3,500 payment was received for an invoice you do not recognize. The amount is large enough to make almost anyone click first and ask questions later.

The Intuit QuickBooks Payment Invoice email scam turns that moment of alarm into a malware download. Its invoice button does not open a normal accounting record. It leads to a fake document portal that says Adobe Reader must be updated.

The downloaded file is presented as Adobe_installer_v6, but it is not an Adobe update. In the examined campaign, the file was a malicious VBScript designed to run code on a Windows computer and retrieve an additional payload.

Intuit and Adobe are not involved in this campaign. The brands, invoice numbers, payment status, and software-update story are props used to make an unknown file feel like a routine part of reviewing a business transaction.

Overview

The email invents a completed $3,500 payment

The subject reads Payment receipt: $3500.00, Withdrawal for Inv #8372628326. Inside, the message says $3,500.00 was received for invoice #QB-784512 and marks the invoice as Paid.

Those numbers are deliberately inconsistent. The subject, invoice record, and button all use different identifiers, which gives the message a busy accounting appearance while making it difficult to match the claim to a real transaction.

The invoice button opens a fake document viewer

The call-to-action says View INV-#34837823. Instead of opening QuickBooks, an Intuit account, or an ordinary PDF, it takes the recipient to a page dressed as an Adobe document service.

The page claims that Adobe Reader is out of date and says a file will download automatically. It then instructs the visitor to find Adobe_installer_v6 in the Downloads folder and run it to see the invoice.

The supposed Adobe update is malicious code

The downloaded item is not a legitimate Adobe installer. The analyzed sample used a VBScript file, a type of script that Windows can execute outside a browser when the user opens it.

The final program delivered by the script was not identified. It could change between campaign waves, so it would be inaccurate to name one confirmed malware family. Possible outcomes include credential theft, remote access, ransomware, or another secondary infection.

• The message claims a $3,500.00 payment was received without any prior context.
• The subject, body, and button show different invoice numbers.
• The button does not lead to the recipient's real QuickBooks account.
• A fake Adobe page says Reader must be updated before the invoice can open.
• The page automatically offers a file named Adobe_installer_v6.
• The downloaded file is a malicious script rather than an Adobe installer.
• The script can retrieve another payload whose exact identity may vary.
• Neither Intuit nor Adobe has any connection with the email.

Why a Fake Payment Receipt Is Such an Effective Malware Lure

Unexpected invoice emails create two competing fears. A recipient may worry that the company was charged for something it never ordered, or that a customer payment was posted incorrectly. Both concerns encourage an immediate review.

Business email also makes attachments and document portals feel normal. Accountants, managers, contractors, and small-business owners regularly receive invoices from people they do not know personally, so the attacker does not need a close relationship with every target.

The $3,500.00 figure is specific enough to look like a real transaction but large enough to create urgency. A vague $0 notice might be ignored, while an enormous claim could feel obviously absurd. The chosen amount sits in a believable business range.

The Adobe update story bridges the gap between the email and the dangerous file. Instead of asking the recipient to run an unexplained script, the page frames the download as a familiar document reader required to view evidence of the payment.

That sequence matters. Each screen answers the concern created by the previous one: the email raises a billing question, the invoice button promises details, and the update page blames missing software when those details do not appear.

What the Message, Download, and Official Guidance Tell Us

Intuit advises customers to inspect the sender and links in unexpected messages. Genuine Intuit email addresses end in @intuit.com, and legitimate account links lead to an intuit.com destination rather than an unrelated invoice or download domain.

Intuit also says it does not send software updates or downloads as email attachments. A payment receipt that suddenly requires a separate reader installer conflicts with that guidance before the file is opened.

Adobe Reader updates should come from Adobe's official application or website. A third-party invoice page has no reason to supply a custom installer, especially one with a vague name and no visible publisher verification.

On Windows, file extensions can be hidden by default. A name that appears to be Adobe_installer_v6 may actually end in .vbs or another executable script type. The icon and visible name are not reliable proof of what the file can do.

The exact secondary payload was not confirmed, but that uncertainty increases the need for containment. A downloader can be reused to install different tools based on the victim, location, security software, or instructions received from an attacker-controlled server.

How the Intuit QuickBooks Payment Invoice Email Scam Works

Step 1: A fake QuickBooks receipt lands in the inbox

The campaign begins with a subject claiming a $3,500.00 payment or withdrawal. The sender display name may include Intuit, QuickBooks, payments, billing, or a service-team label that looks appropriate at a glance.

Display names are ordinary text and can be chosen by anyone. The actual sender domain, Reply-To address, authentication results, and message path provide more useful evidence than a familiar logo beside the message.

Step 2: Conflicting invoice details create a reason to investigate

The body marks invoice #QB-784512 as Paid, while the subject and button use other identifiers. A recipient may interpret those differences as proof that several records or references are involved rather than noticing that the story is inconsistent.

The message offers few useful business details. There is no known customer, purchase order, product description, billing address, tax record, or transaction visible inside the independently opened QuickBooks account.

Step 3: The View Invoice button leaves Intuit's services

Clicking View INV-#34837823 takes the recipient to an outside website. The page may use QuickBooks colors during a redirect, then switch to Adobe branding when it claims the document cannot be displayed.

A redirect does not inherit the identity of the brand shown on the previous screen. The final registrable domain controls the content, downloads, and information collected from the visitor.

Step 4: A fake Adobe warning invents a technical obstacle

The document page says Adobe Reader is outdated or missing. This gives the victim a simple explanation for why the promised invoice is not visible and presents an update as the fastest route to the answer.

Modern browsers can usually display PDFs without a custom installer. Even when a genuine application needs an update, that process should begin inside the installed app or at Adobe's verified site, not at an unknown invoice portal.

Step 5: Adobe_installer_v6 is downloaded to the computer

The site may start the download automatically and show instructions for locating the file. Naming it like an installer reduces suspicion and moves the decision from the browser, where the domain is visible, to the Downloads folder.

The analyzed item was a malicious VBScript. If Windows hides the .vbs extension, a user may see only the reassuring base name and mistake a script for a normal application update.

Step 6: Opening the script starts the malware chain

When the recipient runs the file, Windows can execute its instructions. The script may contact an outside server, collect system information, change settings, or download and launch a larger program without showing a real invoice.

The final payload can be replaced at any time. Treat the event as a possible full compromise even if no window opens, no ransom note appears, and the computer seems to behave normally afterward.

Step 7: The attacker exploits the infected device

A successful infection may expose browser passwords, session cookies, email, files, accounting data, and remote access to the computer. In a company network, one compromised workstation can also become a route to shared systems.

Criminals may use stolen mailbox access to send more convincing invoices, request bank-detail changes, or continue conversations with real customers. That secondary business-email compromise can cause losses long after the original lure is forgotten.

Company and Checkout Checks

Open QuickBooks independently

Use a saved bookmark, the official QuickBooks application, or a manually typed Intuit address. Search invoices, payments, customers, and recent activity for the claimed $3,500.00 transaction without clicking anything in the email.

If the receipt is real, the underlying record should exist inside the authenticated account. If it does not, do not let an outside document page create evidence that the trusted account cannot show.

Compare every identifier with business records

Check the customer name, invoice number, amount, date, purchase order, bank record, and responsible employee. Three unrelated invoice numbers in one short message should be resolved before any document is downloaded.

Call the customer or vendor using a number already held in company records. Do not use the telephone number or reply address supplied by the unexpected message, because those channels may belong to the same attacker.

Inspect the real destination and file type

Hover over the invoice button or copy its destination without opening it. A legitimate QuickBooks action should not require an unrelated domain to deliver a script disguised as an Adobe update.

Enable file-name extensions in Windows and review the file's Properties panel. A .vbs, .js, .cmd, .bat, .scr, .exe, .msi, .iso, or archive file is not a normal invoice document.

Get software updates only from the publisher

Open Adobe Reader and use its built-in update feature, or visit Adobe through a manually entered address. Do not install a reader offered by a document page, advertisement, pop-up, or unsolicited email.

For managed workplace devices, contact the IT team. Employees should not have to bypass security controls or install unknown software merely to confirm whether an invoice exists.

Warning Signs to Check Before You Act

• An unexpected receipt claims a $3,500.00 payment or withdrawal.
• The subject, body, and button use three different invoice numbers.
• No recognizable customer, order, product, or contract is identified.
• The sender domain does not end in @intuit.com.
• The invoice button leaves Intuit and opens an unrelated site.
• An Adobe-themed page says a reader update is required to view one invoice.
• The site starts a download automatically or pressures the visitor to run it.
• The file has a vague name such as Adobe_installer_v6.
• The real file extension is hidden or is a script or executable type.
• No matching transaction appears in the independently opened QuickBooks account.
• The page provides no verifiable digital signature or trusted publisher.
• The message asks for fast action before ordinary accounting checks can be completed.

The decisive clue is not one typo or an unfamiliar sender. It is the entire chain: a payment that cannot be confirmed, conflicting invoice references, an outside document portal, and a supposed Adobe update delivered as executable code.

What to Do if You Have Fallen Victim to This Scam

1. Disconnect the affected computer from the network. If you opened or ran the file connected to the fake QuickBooks invoice, turn off Wi-Fi or unplug Ethernet. Isolation can interrupt command traffic, additional downloads, lateral movement, and the transfer of stolen data while you assess the system.
2. Do not keep reopening the document or installer. Preserve the original email, full headers, link, and file name for your security team, but do not test the Adobe_installer_v6 file again on a normal computer. Uploading it to random websites can expose confidential business material.
3. Run a complete malware scan. Update Malwarebytes or another reputable security product, then perform a full scan rather than a quick scan. Quarantine confirmed threats, restart if requested, scan once more, and record every detection before deleting the evidence.
4. Check for persistence and unfamiliar software. Review startup entries, scheduled tasks, browser extensions, recently installed applications, remote-access tools, new user accounts, and security exclusions. An empty antivirus result does not prove the system is clean if malicious code already changed its configuration.
5. Change important passwords from a clean device. Start with email, company identity, banking, payment services, cloud storage, and password managers. Use new unique passwords and never make those changes on the possibly infected computer until it has been cleaned or rebuilt.
6. Revoke active sessions and strengthen sign-in security. Sign out other sessions, remove unknown devices and app passwords, rotate exposed API keys, and enable a passkey, security key, or authenticator app. A password reset alone may leave stolen session tokens active.
7. Notify the organization responsible for the device. A workplace security team may need to isolate other computers, reset credentials, review mail logs, inspect network activity, and preserve forensic evidence. Early reporting is far safer than quietly waiting for visible symptoms.
8. Watch financial and business accounts. Review invoices, vendor-bank changes, wire requests, card activity, payroll settings, and mailbox rules. Malware delivered through business email can support payment diversion even when the original lure was framed as an ordinary document.
9. Restore only from a known-clean backup. If files were damaged or encrypted, do not overwrite the last good backup. Confirm the threat is removed, rebuild the device when necessary, and restore data from a version created before the suspicious email was opened.
10. Add preventive filtering without relying on it alone. AdGuard or another reputable DNS and content blocker can stop some known malicious pages and advertising redirects. New campaign domains may not be listed immediately, so domain checks and cautious file handling still matter.
11. Report the campaign and reject recovery scams. Use the mail provider's phishing-report feature and notify the impersonated company through its official channel. Ignore strangers who promise to clean the computer, recover funds, or decrypt files for an advance payment.

Is Your Device Infected? Run a Free Malware Scan

Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. A quick way to check is to scan your device with Malwarebytes Free, one of the most trusted malware removal tools available. If you only visited a scam page and didn’t download or install anything, this scan is optional.

The free version detects and removes the most common threats, including:

• Adware — the cause of those annoying pop-ups
• Browser hijackers — unwanted redirects and changed homepages
• Trojans and spyware — hidden programs stealing your data
• Potentially unwanted programs (PUPs) — software you never asked for

👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.

Malwarebytes for WindowsMalwarebytes for MacMalwarebytes for Android

Run a Malware Scan with Malwarebytes for Windows

Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan your PC and remove what Malwarebytes finds.

1. Download Malwarebytes

   Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.

   

   Malwarebytes Free for WindowsScans and removes malware at no cost

   Download MalwarebytesOfficial installer for Windows 11 and 10. Your download starts right away.Want real-time protection? See Malwarebytes Premium

2. Install Malwarebytes

   When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   The setup wizard will walk you through a few quick screens:

   • Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.

     

   • Malwarebytes will now install on your device. This usually takes under a minute.

     

   • When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.

     

   • On the final screen, click Open Malwarebytes to launch the program.

     

4. Optional: Check for rootkits with a Custom Scan

   You don’t need to change any settings for a normal scan. The standard Threat Scan in the next step is enough for most problems, so you can go straight to it.

   If you also want to check for rootkits, use a Custom Scan. In current versions of Malwarebytes, rootkit scanning is only available there:

   1. On the Scanner tile, click the three-dot menu and select Advanced Scan.
   2. Choose Custom Scan. In its options, check Scan for rootkits.
   3. Select your system drive (usually C:\) as the location to scan, then start the scan. It takes longer than a Threat Scan.
   4. When it finishes, review and quarantine the results as described in the steps below.

   Rootkit scanning isn’t available on Windows devices with ARM processors.

5. Start the Scan

   Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.

   

6. Wait for the Scan to Finish

   The scan checks your entire system for browser hijackers and other malicious programs, so it can take 5 to 20 minutes depending on your computer. Feel free to do something else — just check back occasionally to see the progress.

   

7. Quarantine the Detected Threats

   When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.

   

   Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.

   

8. Restart Your Computer

   Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, Malwarebytes has finished removing the threats it found.

   

When the scan is done, check whether the problems you noticed have stopped. If they continue, see the options below.

Keep your PC protectedStop the next infection before it starts

If your antivirus let this threat through, it may not be enough on its own. Malwarebytes Premium adds real-time protection that blocks malware, ransomware, and malicious websites before they can infect your computer.See Malwarebytes Premium

If you are still having problems with your computer after completing these instructions, then please follow one of the steps:

• Run a computer scan with ESET Online Scanner
• Ask for help in our Windows Malware Removal Help & Support forum.

Run a Malware Scan with Malwarebytes for Mac

Malwarebytes for Mac is a free on-demand scanner that removes the malware other security software tends to miss — adware, browser hijackers, and unwanted programs included. Cleaning an infected Mac with Malwarebytes has always been completely free, and it’s our go-to recommendation. Follow the steps below to scan your Mac and remove what Malwarebytes finds.

1. Download Malwarebytes for Mac

   Click the button below to download the latest version of Malwarebytes for Mac.

   

   Malwarebytes Free for MacScans and removes malware at no cost

   Download MalwarebytesOfficial installer for macOS. Your download starts right away.Want real-time protection? See Malwarebytes Premium

2. Open the Malwarebytes setup file

   When the download finishes, open your Downloads folder and double-click the setup file to begin the installation.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   The Malwarebytes for Mac Installer will guide you through a few quick screens. Click “Continue” and keep following the prompts until the installation completes.

   

   

   

   When the installation is complete, Malwarebytes opens to the Welcome to Malwarebytes screen. Click “Get started“.

   Malwarebytes needs Full Disk Access to check your whole Mac. When it asks, open System Settings > Privacy & Security > Full Disk Access, turn on Malwarebytes (it may be listed as Malwarebytes Protection), and confirm with your password or Touch ID. Then return to Malwarebytes. On macOS Monterey and earlier, this setting is in System Preferences > Security & Privacy > Privacy.

4. Select “Personal Computer” or “Work Computer”

   Malwarebytes will ask what type of computer you’re installing it on. Click either Personal Computer or Work Computer, whichever applies.
   

5. Start the Scan

   Click the “Scan” button. Malwarebytes will automatically update its detection database and begin checking your Mac for malware.
   

6. Wait for the Scan to Finish

   Malwarebytes will scan your Mac for adware, browser hijackers, and other malicious programs. This can take a few minutes, so feel free to do something else — just check back occasionally to see the progress.
   

7. Quarantine the Detected Threats

   When the scan is done, you’ll see a list of everything Malwarebytes found. Click the “Quarantine” button to remove all the threats at once.
   

8. Restart Your Mac

   Malwarebytes will now remove all the malicious files it found. Some threats can only be fully removed after a reboot — if Malwarebytes asks you to restart, allow it. Once you’re logged back in, check whether the problems you noticed have stopped. If they come back, save the scan report and ask for help in our forum.
   
   

If the problems you noticed continue after the scan, see the options below.

Keep your Mac protectedStop the next infection before it starts

If your Mac got infected, its built-in protection may not be enough on its own. Malwarebytes Premium for Mac adds real-time protection that blocks malware and adware before they can infect your Mac.See Malwarebytes Premium

If you are still experiencing problems while trying to remove a malicious program from your computer, please ask for help in our Mac Malware Removal Help & Support forum.

Run a Malware Scan with Malwarebytes for Android

Malwarebytes for Android scans your phone or tablet for malware, adware, and potentially unwanted apps. The free version scans only when you start a scan. Real-time protection, which checks apps automatically, is part of the paid Premium version.

1. Download Malwarebytes for Android.

   You can download Malwarebytes for Android by clicking the link below.

   

   Malwarebytes for AndroidScans your phone and removes malware at no cost

   Get Malwarebytes for AndroidOpens Google Play in a new tab.Want real-time protection? See Malwarebytes Premium for Android

2. Install Malwarebytes for Android on your phone.

   In the Google Play Store, tap “Install” to install Malwarebytes for Android on your device.

   

   When the installation process has finished, tap “Open” to begin using Malwarebytes for Android. You can also open Malwarebytes by tapping on its icon in your phone menu or home screen.
   

3. Follow the on-screen prompts to complete the setup process

   When Malwarebytes opens, it walks you through a short setup. Tap Get started and follow the prompts. If you see an offer for a trial or a paid plan, read it before you accept. You can skip it and keep using the free scanner.

   Malwarebytes will ask for permission to access the files on your phone so it can scan them. Tap Allow, or turn on the permission in the Android screen that opens, then return to Malwarebytes.

4. Run a scan with Malwarebytes for Android

   On the main screen, tap Scan now. In some versions, you open the menu, tap Scanner, and then tap Run a scan.

5. Wait for the Malwarebytes scan to complete.

   Malwarebytes will now start scanning your phone for adware and other malicious apps. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
   

6. Remove the detected apps.

   When the scan has been completed, you will see a list of the threats that Malwarebytes for Android has detected. Next to each detected item, tap the menu icon (three dots), then choose to uninstall the app or delete the file. Android then asks you to confirm. Tap OK or Uninstall to remove the app.

7. Restart your phone.

   When the detected apps are removed, restart your phone if Malwarebytes asks you to. Then check whether the problems you noticed have stopped.

---

If the problems you noticed continue after the scan, see the options below.

Keep your phone protectedStop the next infection before it starts

Malwarebytes for Android Premium adds real-time protection that blocks malicious apps and scam links before they can harm your phone.See Malwarebytes for Android

If you are still having problems with your phone after completing these instructions, then please follow one of the steps:

• Ask for help in our Mobile Malware Removal Help & Support forum.
• Only as a last resort, reset your phone to factory settings. Read the warning below first.

A factory reset erases everything on your phone. Your apps, photos, files, and settings are deleted, so use it only if the problem continues after the steps above and after you’ve asked for help. Before you reset:

• Back up your photos, videos, files, and messages, for example to your Google account or a computer.
• Make sure you know your Google account email and password. The phone asks for them after the reset. If you changed the password recently, Google recommends waiting 24 hours before you reset.
• On a Samsung phone, also make sure you know your Samsung account password.
• If you use an authenticator app for two-step verification, move your accounts to another device or save your backup codes first.

On a Google Pixel, go to Settings > System > Reset options > Erase all data (factory reset). On a Samsung Galaxy phone, go to Settings > General management > Reset > Factory data reset. Menu names differ on other phones, so check your manufacturer’s support site.

Stay Protected: Block Ads and Malicious Sites

No scan can prove a device is completely clean, so it helps to block threats before they reach you. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.

We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.

👉 Download AdGuard and browse safely

Frequently Asked Questions

Is the Intuit QuickBooks payment receipt genuine?

No. The documented message impersonates QuickBooks, invents a $3,500.00 payment, and sends the recipient to a fake Adobe update. Intuit has no connection with the campaign.

Was my company really charged $3,500.00?

The email does not prove any charge or payment occurred. Check the real QuickBooks account, bank records, cards, and customer ledger through independently opened services before contacting anyone.

What is Adobe_installer_v6?

In this campaign, that name was used for a malicious VBScript rather than a legitimate Adobe installer. The same campaign can change the name or file type in later messages.

What happens if I clicked the invoice button but downloaded nothing?

Close the page, clear any unexpected browser download, and report the message. If you did not run a file or enter credentials, infection is less likely, but review the Downloads folder and browser history.

What if I ran the downloaded file and nothing happened?

Assume the computer may be compromised. Disconnect it, contact IT, run a full security scan, inspect persistence, and change important passwords from a different clean device.

Can a real QuickBooks invoice require an Adobe update?

A genuine invoice may be offered as a PDF, but software updates should come from the installed application or Adobe's verified site. An unrelated invoice page should never supply an executable reader update.

The Bottom Line

The Intuit QuickBooks Payment Invoice email scam uses a believable accounting problem to disguise a malware-delivery chain. Its $3,500.00 receipt, conflicting invoice numbers, and polished brands are designed to make a dangerous download feel like routine paperwork.

Do not investigate the claim through the message. Open QuickBooks and financial records independently, confirm the transaction with known contacts, and obtain software only from its official publisher.

If Adobe_installer_v6 or another file was opened, respond as though the computer may be compromised. Isolate it, scan it thoroughly, protect connected accounts, and involve the appropriate security team before normal work resumes.