0

Late last night I received a "password reset" email from [email protected].

It looked legit, but I had not requested a password reset. I checked my account's "recent account access" but saw nothing unusual there.

I did not click through and did not reset my password via any other channel. I just left it.

Early this morning I received another email, approx 3 hours after the first

Subject line: - Netflix - Unlock your account -

Email Info:

 from: Secured Customer <[email protected]> reply-to: "[email protected]" <[email protected]>

Email contents:

- Encrypted attachment – This message contains 1 encrypted attachment. This message can only be opened by <my-email>. PDF password : 2121

Attached is one file named "Netflix - Unlock -.pdf" which is 112K long.

Is there anything I should be doing about this, apart from ignoring it? (Either for myself, or as a socially responsible "netizen")

Improve this question

2 Answers 2

Reset to default
2

Late last night I received a "password reset" email from [email protected].

According to this netflix emails should come from here [email protected].Please check the SPF and DKIM/DMAC.If it passes then this is official netflix mail.

BUT

from: Secured Customer reply-to:
"[email protected]" Attached is one file named "Netflix - Unlock -.pdf" which is 112K long.

This email right here is the sketchy one. This MIGHT be a malware.My guess is they used the netflix password reset on your email and when the email went through then try to phish you with a malware.But again i could be wrong BUT it would be best not open that PDF file

Is there anything I should be doing about this, apart from ignoring it? (Either for myself, or as a socially responsible "netizen")

  1. Mark the email as spam so that the system can mark other such emails as spam.
  2. Upload the pdf to virus total if you can.

I wont comment on legal.I have no knowledge of it

Improve this answer
2
  • Marked as correct because (1) External reference to correct Netflix email (2) I didn't know about Virus Total (3) Advice to mark dodgy email as spam. Commented Jul 24, 2019 at 4:57
  • @vidarlo Did you even read what i wrote?I clearly said the PDF is a malware and the password reset was from netflix.The OP got two emails as he says:one from netflix and then one from someone else Commented Jul 24, 2019 at 5:48
4

First, this is not an attack via Netflix, is an attack spoofing the email sender. It could be anything: Apple, NASA, whatever. Spoofing an email sender is as easy as writing any name and address on an paper envelope and sending it.

The PDF file is protected so some antivirus software and automated scanners will not be able to detect malware on it.

What you do? Ignore it.

Someone will probably tell you to send it to Netflix, but they have nothing to do with it, and cannot help but tell you this email is not from them.

Improve this answer
5
  • Well, it may look like Netflix is leaking data about if an email is registered there or not, which does have something to do with them. Commented Jul 29, 2019 at 11:42
  • The email is coming from Hotmail, not Netflix. And if you target an US email address, you have good chances of hitting a Netflix customer. They are not leaking anything. Commented Jul 29, 2019 at 12:33
  • 1
    But he got the password reset mail from Netflix first. I just checked. If I enter my own email for a password reset, it says "email sent", but if I type in some random email, I get "no account for this email". So yes, they do leak if a person is customer there and help spammers find valid email addresses. Commented Jul 29, 2019 at 12:40
  • You are talking about 2 different scenarios: one is what OP is asking, another is Netflix leaking emails. Almost every service out there does the same, and bug bounties for almost every service says "username leakage is not a vulnerability." In OP case, Netflix does not have anything to do with the email, just got its name used. Commented Jul 29, 2019 at 18:00
  • He got two emails, the first one is an official password reset from netflix, that came when the attackers veryfied he had an account there. After veryfing, the attackers then sent an email themselves, now knowing he had an account there. That it's not bounty worthy or that everyone does it is irrelevant, they still did leak his email. You can't refute that.. Commented Jul 30, 2019 at 5:56

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.