Tell HN: Thailand pass applicants receive malicious code via email | Hacker News Reader

Tell HN: Thailand pass applicants receive malicious code via email

25 pointsMoSattler8 comments

Me and my girlfriend are planning to go to Thailand. Today we got another email from the Thailand pass people (needed for entry):

  There is a problem related to the request, please download the attachment and update the information.

  Please prepare your documents for submission at the check-in desk and relevant agencies
  Passport with visa (if required)
  Thailand pass QR code (on mobile device or hard copy)

  Download Document

  https://bit.ly/XXXXXXXXXXX

  important note. You must open the document from a PC and not from the phone

The link is leading to an HTML file hosted on discord, which is prompting the user to download some malicious VBS code.

It's easy to detect for technically apt people, but it almost fooled my girlfriend.

View on HN

Throwaway - this happened to me. For anybody curious, my guess is somebody hacked the server or figured out some URI enumeration vulnerability and at minimum gets your email when you submit the application.

You then get an email from "Thailand Pass <support@consulatelteamthailand.com>" (hacker I guess) saying there was a problem with your application and requesting your name, DOB and last 4 of passport. When you reply you get another email with the bitly link the OP shared, which then eventually (in a roundabout way, involving having you download a copy of a mock version of the real site) gets you to download a zipped vb script file.

IMO the sad part of this and what made it actually believable to me is that the Thai government is so disorganized generally, and does things in such an ad-hoc way that if you've been living here awhile it actually seems plausible that this is somehow real...

> It's easy to detect for technically apt people, but it almost fooled my girlfriend.

When you open the official Thailand Pass registration page, the scam email warning is literally the first thing you see. It is a popup that obscures the rest of the page.

Read and heed that warning, it's not for nothing.

And don't ask me why they just don't plug the leak if they know it happens, I don't work there. Maybe an old system in a different government branch or department leaks it, no idea.

Maybe they should just not leak application data instead of warning people about phishing emails?

If they leaked application data, that scam email would not ask people for passport number and so on. Clearly they leak emails only.

https://thethaiger.com/hot-news/tourism/warning-thailand-pas...

I received this but never saw it until I read articles about this. It was automatically sent to the spam box on gmail.

What address did the email come from, and what do the headers show? Anything to indicate it's a spoofed email?

Wouldn't have happened if they'd get rid of this useless scheme all together.

Reply on news.ycombinator.com