There’s a not-so-new cybercrime hitting inboxes everywhere and it’s using phishing invoices to install a variety of malware, including an info-stealer. While some of us regularly get invoices in our inbox for this or that, we should all be aware of this invoice-themed phishing attack that’s likely to show up to collect payment in your email soon.

This attack starts with getting an email saying a package has been delivered and there’s an invoice attached. Getting an email like this, especially for something we didn’t buy, can instill fear, panic, anger, and other reactions. These strong emotions understandably lead us to opening the invoice, and that sets the attack in motion. Hackers expect these reactions from us and in this phishing attack, it’s their “gotcha” moment.

Once the attachment is opened, attackers have a bunch of malware plug-ins at their disposal, depending on their goal. From all accounts, it’s a sophisticated attack full of smoke screens and evasion techniques. Installing VenomRAT, a “multi-purpose” Remote Access Trojan that’s also for sale on the Dark Web, gives the hacker control over the attack.

Among various talents, VenomRAT is also an info-stealer. This RAT sends the hacker a victim’s keystrokes, records camera use, and steals valuable PII. Some of that stolen PII includes credit card details, crypto wallet data, passwords, desktop files, browser data, and cookies. What crimes a hacker commits with this information is known only to them until a victim realizes something is terribly wrong — and by then it’s usually too late.

As everyday users, it can sometimes feel like the deck is stacked against us. This invoice phishing attack, like most others, takes advantage of us being human. Since humanity is something we can’t avoid, knowing phishing red flags when we see them should be part of our daily cyber-smart routine. Like this attack, look out for those signs: Typos and grammar errors, blurry graphics, anything that tickles the back of your neck. Unexpected emails with attachments and/or links should all be suspect, especially when they elicit a strong reaction from us. So, stay cyber-smart, stay calm, and kick invoice phishing to the curb.