Wrote: Etrit Rexhepi
An email has been found claiming that the Red Bull company is looking for workers.
This email was sent in English from an email address "messaging-service@post.xero.com" and contains a link where you can click and apply for this alleged job position.
But what's wrong with this email?
This message is a scam and could put your data at risk if you click on the link it contains.
Hibrid.info has researched the website “xero.com”, which contains the sending email address. “Xero” is a platform designed to help small businesses manage their finances (see here).
In the ongoing research using the Google search engine, an article published on "mailguard.com.au" was found, which explains the emails sent on behalf of this platform (see here).
The article shows that a fraudulent email campaign exploiting the well-known name of cloud accounting company Xero is spreading dangerous malware.
The emails look like legitimate invoices sent from Xero, but the sender address has a slight difference (from messaging-service@post.xero.com IN messaging-service@postxero.com). They contain a link that leads to a malicious page, where a JavaScript malware (Trojan) is automatically downloaded.
This Trojan can steal sensitive data such as passwords, banking information or remain hidden for future use. Victims can be anyone, even those who do not use Xero.
To spot the scam, the article explains that legitimate invoices from Xero usually have a PDF attached, not a link, and also points out that you can check the email address to see if it matches the official Xero domain.
In the case of the email in question, the email address appears to be the same as the official Xero address. A search by hibrid.info found that we are dealing with a cyberattack called email spoofing.
Email spoofing occurs when an attacker manipulates the fields of an email (such as “From,” “Reply-To,” “Subject,” etc.) to make it appear as if it comes from a trusted source. The email program displays this false information, deceiving the recipient (see here).
Hibrid.info has found an explanation from this platform on its informational website “central.xero.com”, which is dedicated to providing information on various issues (see here).
Representatives of this platform advise that if you receive any suspicious email, report it to them via the address: phishing@xero.com, sending a screenshot or full information of the email, not to click on any suspicious links, and if you have accessed a potentially dangerous site, immediately change any passwords you have entered and perform a malware scan on your device.
To further confirm the suspicions about this email, hibrid.info, through the "scam-detector" website domain evaluation platform, checked for the link contained in the email message.
According to this platform's assessment, the checked link is suspicious (see here).
As for the job postings from RedBull, hibrid.info has found that the company has a website where you can apply for a job (see here).
Analyze
The email, claiming that Red Bull is looking for workers and offering a link to apply, is a scam that aims to deceive the recipient and jeopardize their security.
This email uses a technique known as "email spoofing", pretending to be the official address "messaging-service@post.xero.com" to create false credibility and entice the recipient to click a dangerous link, which could install malware or steal personal data.
Meanwhile, neither Xero (the platform on whose behalf the email was sent) nor RedBull (the company allegedly seeking workers) are related to this false announcement.
Therefore, based on the work methodology, hibrid.info evaluates it as "Fraud".
Reasoning:
The “Deception” rating is given to informational content that is manipulated in terms of visual (deepfake, cheapfake), audio, or textual content to deceive the audience. This form of deception is usually used to produce false and manipulated content.