The method enabled the emails to bypass standard threat-detection controls. Instead, the only call to action in the email was a phone number that would supposedly connect the recipient to the вЂњbilling departmentвЂќ in order to process order returns, the researcher explained. The emails likely avoided suspicion because the messages didnвЂ™t include any random links вЂ“ usually the hallmark used for spotting malicious emails or scams. The attackers used the same look and feel from a branding perspective as the real Geek Squad, Iyer said, and the email body language вЂњcarefully the line between vagueness and urgency-inducing specificity.вЂќ

In the first campaign that Armorblox uncovered, the scammers impersonated the service by sending emails (from a Gmail account) that masqueraded as a renewal confirmation for an annual protection service. Geek Squad is an IT support service focused on consumers and small businesses, owned by consumer-electronics retailer Best Buy. вЂњThis means the emails skipped spam filtering because Microsoft determined they were from a safe sender to a safe recipient or were from an email source server on the вЂIP AllowвЂ™ list.вЂќ Geek SquadвЂ¦to the Rescue? вЂњMicrosoft assigned a spam confidence level (SCL) of вЂ-1вЂ™ to both emails,вЂќ explained researcher Abhishek Iyer, writing in a Thursday posting. In this case, researchers said the gambit consisted of sending fake order receipts via email, and then including phone numbers to call вЂњfor processing order returns.вЂќДЄccording to researchers at Armorblox, the emails bypassed native Microsoft email security controls along with email security engines like Exchange Online Protection (EOP) and Proofpoint, landing in tens of thousands of corporate inboxes. Vishing (a contraction of вЂњvoice phishingвЂќ) generally involves stealing personal information from victims over the phone or leaving fraudulent voice messages. A pair of billing and tech support вЂњvishingвЂќ attacks using Geek Squad and Norton Antivirus as cover managed to hit 25,000 mailboxes recently, questing after victimsвЂ™ credit-card details.

Norton antivirus scam