Has ESET been hacked ?

Today I got an (fake) email from Eset

If you start the link, they will ask you for credit card details, so I i think this is a fake, Maybe just
users in Germay are affected. Don't know from where they got my full name, maybe they hacked the database of
a German reseller.

Source address from server.affairs4u.com (server.affairs4u.com [216.246.29.28]), which is located within
the Chicago area.

Anyone else got this mail ?

This is the mail:

 

Good morning,

we received the same e-mail today. The mail is correctly adressed to the person who registered at ESET.

Hoping for a statement from ESET Germany if customer (and possibly credit card data) has been stolen.

Best regards,
Christian

 

Same mail for me

 

That is very bad news! Have you posted this information over at Eset's New Forum here https://forum.eset.com/ I hope it was only a reseller, but at any account this is very bad news. If there has been a security breach where user's credit card info was compromised then it was not everyone's because they would not ask you for it if they already had it. Who knows though; other user's may not be so lucky. I usually don't save my credit card info with any vendors since I have no way of knowing if their servers will be compromised. I think most companies give you an option whether to save your Credit Card Info on their sites. At any rate I would not want them to steal any of my data. Sometimes they can capitalize off just getting a little of your data by using it to get the rest they need which is want they attempted on you. They should know Eset user's are smarter than that lol

 

It wasn't a reseller, I bought my licenses directly at the license shop.

 

Nassel2k, could you post the link from which you purchased your license? I want to make sure it's their main website.

 

http://www.eset.com/de/home/products/

That looks like their main page to me

 

Have the same issue ( see other post )

 

Well, that makes 2 users that has posted in this thread saying they received the email, and they bought their license directly from Eset. This could be a bigger problem than I hoped for. I guess we will just have to wait until Eset addresses this issue. I myself have not received an email yet. I live in the USA.

 

I´ve got that email today, too. I already bought the licence directly from Eset in January. Country: Germany.

Now waiting for an official reply from Eset.

 

Just talked to eset Germany support. They are aware of the problem and currently investigating source, leakage and partner processes as it appears the currently only licenses are affected beeing purchased through esets official shop ( licenses purchased through assigned partners don't seem to be affected so a leakage in the shopsystems could be source of adresses).
Up to now, it seems to be a German problem only ( which does it not make less problematic)

In my customer base, the problem is reported by one customer which had his license through the shop. there have been no reports so far by customers directly served by the partner channel.

BTW. This issue is now also documented on forum.eset.com

 

same here.
from: @server.affairs4u.com
using: http://esetnod.tld.cc
my location: Germany
I bought it directly from the german ESET shop, using an email address that was only available to ESET.

 

That adress shows phishing website on my chrome browser.

 

The same here!

- the Mail to my registered email-Adress (without German-Umlaut)
- correct spelled Reg-Name (with Umlaut)
- ESS bought direct at Eset

What is it.

Eset has updated the Signaturefiles for NOD/ESS:


Kind Regards

 

Same issue for me... I am an ESET customer (Smart Security) for many years and always purchased and extended licenses for me, my family and friends in the official German online shop of ESET.

It is sad, that ESET has not yet send an official notification to all the customers telling them to ignore the fake email and that more details about what has happened will be distributed soon.

best regards
Hendrik

 

There are several threads about it at the new Eset forum:

[noparse]https://forum.eset.com/topic/462-has-eset-been-hacked/[/noparse] - thread moved/merged to link added below - LowWaterMark

New link: https://forum.eset.com/topic/466-phishing-email-targetting-german-eset-users/

https://forum.eset.com/topic/460-possible-compromise-of-eset-customer-info-german-reseller/

=====

Report at heise.de (in German):
http://www.heise.de/security/meldung/Gezielter-Phishing-Angriff-auf-Eset-Kunden-1897681.html

 

Look at the horrible grammar and spelling in the e-mail. That is a dead giveaway it is fake.

 

@HenSch


http://www.eset.com/de/about/press/news/article/eset-warnt-vor-gefaelschten-e-mails/

 

https://www.wilderssecurity.com/showthread.php?t=349485

 

Nice news, but this information should be sent by email to the customers.
I know many people who are not so familiar with IT topics and all the risks and I am sure they will not visit heise.de or the ESET homepage and read the company news every day or every week. And they also do not have perfect English skills, so they will not recognize the wrong grammar.

If they check their email inbox today evening and they see one email from ESET in English (the fake) and another one with a subject like "Warning! Faked emails..." (in German), this would really minimize the risk.

At the moment I am doing this job and tell them that they should ignore this email.

best regards
Hendrik

 

Eset did send out warnings regarding the phishing mail in the late evening.

Any up-to date Eset program shows it as phishing trojan aswell.

 

Now these email addresses are also used for Paypal phishing. Its the same code on the website used for Paypal phishing:

Paypal-Phishing (today)

Code:

<form name="main" id="main" method="POST" action="/Gooodshot.php">
<input id="swich" name="swich" value="0" type="hidden">
<input name="user" value="" type="hidden">
<input name= "pass" value="" type="hidden">
<input name="defaultaddress" value="" type="hidden">
<input name="ip" value="41.251.67.216" type="hidden">
<input name="Send" value="shadyflw@gmail.com" type="hidden">

Eset-Phishing (before)

Code:

<form name="main" id="main" method="POST" 
action="Gooodshot.php">
<input id="swich" name="swich" value="0" type="hidden">
<input name="user" value="" type="hidden">
<input name="pass" value="" type="hidden">
<input name="defaultaddress" value="" type="hidden">
<input name="ip" value="41.251.67.216" type="hidden">
<input name="Send" value="shadyflw@gmail.com" type="hidden">

 

There's a 'shadyflw' here: 4shared.com/u/WE-4-elp/shadyflw.html

It has thousands of downloads, and I think you can get so many downloads only with tricks as the ad.fly redirection or other pay-per-click scripts...

EDIT: Looking at the link on post #25, maybe the downloads come from an mp3 file.

Wonder if it's related, if not I'm sorry for the false alarm!

 

This user says he's located at Morocco, IP 41.251.67.216 also is located at Morocco. But the phishing attack seems a little bit 'old fashioned'. Maybe, he only bought the cracked data from the black market (Russian crackers).

Now the German magazine publisher Heise also has a report:

http://www.heise.de/security/meldung/Phishing-Mails-im-Namen-von-Paypal-an-Eset-Kunden-1910448.html

 

This link (auf Deutsch) confirms that the 4shared account includes a file related to 'bank scams'... http://www.antispam-ev.de/forum/sho...Namen-von-Eset&p=358596&viewfull=1#post358596