Warning about email “Debit could not be carried out”

In the last few days there has been an increase in emails claiming that direct debits could not be debited from the account.

We received several of these emails from users, all of which have one thing in common: they contain a link that downloads a Trojan onto the PC!

Here are some examples of the emails:

Dear customer XXX YYY,
we have noticed that the payment request ID 73820014 has still not been posted.
We still give you one last opportunity to fulfill your obligation by immediately paying us the outstanding amount of 795.00 EURO.
You can view order details and account details in your profile on the website.
If the invoice is not paid, we are obliged to take enforcement action against you.
To avoid this inconvenience, you should pay the bill immediately. Please note that in addition to paying interest on the claim, the debtor must also compensate for any further damage caused by the delay.

AllforEves Ag
82140 Olching

Dear customer XXX YYY,
we have discovered that invoice number 6486251006 has still not been paid.
However, we give you one last opportunity to fulfill your contractual obligation by immediately paying us the outstanding invoice in the amount of 828.00 EURO.
You can view the details of your order and the invoice in the online shop on the website.
If the debt is not paid, we are also legally obliged to take enforcement action against you.
To avoid this inconvenience, you should pay the bill immediately. XXX YYY Please note that in addition to paying interest on the claim, the debtor must also compensate for any further damage caused by the delay.

Farbenmix Ltd.
64646 Heppenheim (Bergstrasse)

Hello XXX YYY,
we discovered that our reminder NO.
97583977 has still not been paid. However, we still give you one last chance to fulfill your contractual obligation by immediately paying us the outstanding amount of 889.00 EURO.
You can find the order details and bank details in your profile under the link.
If the invoice is not paid, we are also legally obliged to take enforcement action against you.
To avoid this inconvenience, you should pay the bill immediately. XXX YYY please note that the consequences of default are primarily the debtor's obligation to seek recourse and increased liability.

Feisty GmbH
15890 Eisenhüttenstadt

Hello XXX YYY,
we discovered that claim number 56176617 had not been paid.
However, we give you one last chance to fulfill your obligation by immediately transferring the outstanding amount of 744.00 EURO to us.
The details of the order and the invoice can be found in the online shop using the link.
XXX YYY Please note that in addition to paying interest on the claim, the debtor must also compensate for any further damage caused by the delay.
If the invoice is not paid, we are also legally obliged to take enforcement action against you. To avoid this inconvenience, you should pay the bill immediately.

Discount24 GmbH
59581 Warstein

What is striking is the almost identical wording of the emails, always signed by different companies that probably don't know anything about the emails.
In addition, the links always contain the full first and last name of the recipient, which suggests that the fraudsters have the names and emails from a database leak.

If you click on the link contained in the email, you will not see an online account or an invoice; instead, you will be asked to download a compressed file in ZIP format.

Attention, Trojans!

However, the ZIP file doesn't even contain a document, but rather an executable file:

When this file is executed, various Trojans are downloaded and installed on the PC.

Conclusion

The emails themselves are quite plain, the texts are similar, and the signatory is always a different company. You should avoid the link in the email if you don't want to contaminate your PC with Trojans!