惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

雷峰网
雷峰网
L
LangChain Blog
GbyAI
GbyAI
F
Fortinet All Blogs
腾讯CDC
Last Week in AI
Last Week in AI
A
About on SuperTechFans
J
Java Code Geeks
Microsoft Azure Blog
Microsoft Azure Blog
博客园 - Franky
B
Blog
D
Docker
G
Google Developers Blog
月光博客
月光博客
博客园 - 三生石上(FineUI控件)
S
SegmentFault 最新的问题
Apple Machine Learning Research
Apple Machine Learning Research
酷 壳 – CoolShell
酷 壳 – CoolShell
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
T
Tailwind CSS Blog
宝玉的分享
宝玉的分享
U
Unit 42
Blog — PlanetScale
Blog — PlanetScale
B
Blog RSS Feed

Comments for Securelist

MosaicRegressor: Lurking in the Shadows of UEFI Analyzing the vulnerability landscape in Q2 2026 CoolClient backdoor goes deeper: HoneyMyte adds Windows kernel rootkit Kimsuky’s GoldDragon cluster and its C2 operations Project CAV3RN uses Google Apps Script for stealthy C2 in Israel Phishers are hijacking legitimate cloud infrastructure New BitLocker extortion activity: RDP, MSSQL, RMM Abuse How to improve your organization's security based on compromise assessment findings SparkCat crypto stealer in Google Play and App Store How the ToddyCat APT group gains access to Gmail accounts The Gentlemen RaaS: rapid growth and a new ransomware variant Threat landscape for SMBs in 2026: fake AI tools, phishing and more Telegram phishing bots and channels: how it works An unknown actor distributes malicious VBS scripts via WhatsApp MiniPlasma: detecting exploitation Argamal: Malware hidden in hentai games Containers on fire: from container escapes to supply chain attacks What’s in the container? Analyzing vulnerabilities, risks and protection with Kaspersky Container Security and Free Internet Kimsuky targets organizations with PebbleDash-based tools State of ransomware in 2026 Copy Fail: root on virtually any Linux Popular DAEMON Tools software compromised Congratulations, you’ve won! The reality behind online lotteries Operation ShadowHammer: a high-profile supply chain attack PhantomRPC: A new privilege escalation technique in Windows RPC Operation Triangulation: The last (hardware) mystery Scammers’ delivery service: exclusively dangerous Operation Triangulation: iOS devices targeted with previously unknown malware Anatomy of a Cyber World Global Report 2026
‘Nigerian’ Letters - Now With a Syrian Twist
Manuela Rijk · 2026-04-26 · via Comments for Securelist

Spam and phishing

Spam and phishing

minute read

The continuing conflict and the complex political situation in Syria have created the perfect conditions for new ‘Nigerian’ scams. In recent months, there has been a surge in the number of Nigerian letters that contained some sort of reference to Syria; scammers sent messages both in the names of ordinary citizens of that country and on behalf of representatives of banks and humanitarian organizations. The texts of the messages made frequent use of words such as “turmoil”, “crisis” or “revolution”.

The scam messages, written in the names of representatives of reputed Syrian and UK banks, stated that their clients would like to transfer their multi-million savings from their accounts because of the unrest in Syria, and were looking for a partner who would help them to do so. Naturally, “compensation” was offered, of which the scammers were ready to tell the recipient either immediately or once they had received a reply. The scammers gave a contact phone number and an email address; the latter could be either the sender’s address or the personal email of the “bank’s client” who allegedly needed help. The scammer’s aim was to entice the victim into an email exhange. After all details of the future partnership are discussed, the victim will most probably be asked to perform a service, e.g. transfer a small amount of money to pay for the mediator’s services. When the money is transferred, the scammers will vanish just as suddenly as they appeared.

The scammers posed as members of the International Committee of the Red Cross, and told the sad story of an oil trader who had died in the Syria turmoil, and whose fortune was saved by a Red Cross employee. As you might expect, the sender asks for help in transferring and looking after the money. The recipient of the letter would supposedly receive the promised millions in a parcel that would first be delivered to Iraq and then to the recipient’s country of residence. For his or her help, the recipient is promised half of the money. In addition, the scammers state they would welcome any advice or assistance on how to make a profitable investment. The scammers give a personal email address for contacting them.

Some of the emails we have seen appear to have been sent using the names of ordinary people, and came in a variety of flavors. For instance, a “teacher from Syria” asked in one message to help orphaned children who had inherited a large sum from their parents to leave the country and invest the money.

Other Nigerian letters are allegedly written on behalf of people who are critically ill and who would like to donate some of their money. The letters ask their potential victims to help them do so. Other messages are very brief, contain no proposals for cooperation and only suggest getting to know the recipient better. This is a trick aimed at getting the victim’s attention and enticing them into further communication.

The Nigerian scammers use a wide variety of tricks; one thing they have in common, however, is that all messages take advantage of people’s natural desire for “easy” money and to help people in distress. The scammers concoct all sorts of stories – at times, far-fetched – and use the names of well-known people and major events to make the victim believe them. Of course, users should not respond to these types of emails. Otherwise, once you find yourself in communication with a Nigerian scammer, you risk losing your money.

  • Latest Webinars
    Reports

    Kaspersky researchers analyze updated CoolClient backdoor and new tools and scripts used in HoneyMyte (aka Mustang Panda or Bronze President) APT campaigns, including three variants of a browser data stealer.

    Kaspersky discloses a 2025 HoneyMyte (aka Mustang Panda or Bronze President) APT campaign, which uses a kernel-mode rootkit to deliver and protect a ToneShell backdoor.

    Kaspersky GReAT experts analyze the Evasive Panda APT’s infection chain, including shellcode encrypted with DPAPI and RC5, as well as the MgBot implant.

    Kaspersky expert describes new malicious tools employed by the Cloud Atlas APT, including implants of their signature backdoors VBShower, VBCloud, PowerShower, and CloudAtlas.