“Salary Review” Email Scam

The “Salary Review” email scam is an elaborate phishing campaign that masquerades as a notification from an organization’s Human Resources (HR) or payment management department. It claims to announce the launch of a salary review portal. However, this is a ploy designed to steal email account credentials and potentially compromise entire corporate networks.

---

Summary of the “Salary Review” Threat

Aspect	Details
Threat Type	Phishing, Scam, Social Engineering, Fraud
Associated Email Addresses	Varies depending on the campaign, often mimicking HR or payroll addresses
Detection Names	May vary depending on security software (e.g., “Phishing.Email”, “Scam.Email.Salary”)
Symptoms of Infection	Unauthorized account activity, identity theft, fraudulent purchases, malware infections
Damage	Loss of sensitive information, monetary theft, corporate network compromise
Distribution Methods	Deceptive emails, rogue ads, misspelled domains, search engine poisoning
Danger Level	High

---

Understanding the “Salary Review” Email Scam

The “Salary Review” phishing email often carries a subject line such as “ANNOUNCEMENT OF SALARY REVIEW AND PORTAL ACCESS.” It falsely claims that the company is initiating a salary review process to reward employees for their efforts. The email includes a link to a so-called “Salary Review Portal,” which is, in reality, a phishing website. This malicious site mimics the login page of the recipient’s email provider.

Content of the Scam Email

• Introduction: The email emphasizes the employer’s commitment to rewarding employees and aligning compensation with industry standards.
• Portal Functionality: It claims the portal will allow employees to review performance summaries, provide feedback, and track salary review progress.
• Fake HR Branding: The email is often signed by “Human Resources” or “Payroll Manager” to appear legitimate.

Goals of the Scam

Once victims enter their login credentials, scammers gain access to their email accounts. This access allows cybercriminals to:

1. Steal sensitive information: Emails often contain confidential data.
2. Spread malware: Attackers can use the email account to distribute trojans or ransomware.
3. Perform identity theft: Compromised accounts can be used to impersonate victims and defraud their contacts.
4. Financial theft: If linked accounts like online banking or e-commerce platforms are compromised, scammers can make fraudulent transactions.

---

Removing the Threat

Step 1: Disconnect from the Internet

If you suspect a phishing attack, disconnect your device from the internet to prevent further exposure.

Step 2: Change Your Passwords

• Email Accounts: Immediately update your email password, ensuring it is strong and unique.
• Linked Accounts: Change passwords for other platforms linked to your email, such as banking, e-commerce, or social media accounts.

Step 3: Use SpyHunter to Scan for Malware

1. Download SpyHunter: Install SpyHunter’s anti-malware tool.
2. Run a Full System Scan: Open SpyHunter and initiate a full system scan to detect any malicious software installed via phishing.
3. Quarantine and Remove Threats: Use SpyHunter to quarantine and remove any detected threats.

Step 4: Monitor Your Accounts

• Check for unauthorized transactions or changes to your online accounts.
• Review email settings to ensure no unauthorized forwarding rules or changes have been made.

Step 5: Inform Relevant Parties

• Notify your employer’s IT or HR department if the phishing email impersonated your workplace.
• Inform your bank or other financial institutions if you suspect financial details were compromised.

---

Preventive Measures to Avoid Future Infections

1. Enable Two-Factor Authentication (2FA): Add an extra layer of security to your email and other accounts by enabling 2FA. Even if your password is compromised, attackers cannot access your account without the second authentication factor.
2. Verify Email Senders: Always check the sender’s email address for inconsistencies. Legitimate HR or payroll communications will come from official company domains.
3. Avoid Clicking on Suspicious Links: Hover over hyperlinks to inspect the URL before clicking. Do not click on links that lead to unfamiliar or misspelled domains.
4. Use Anti-Malware Software: Regularly update and scan your device with trusted anti-malware tools like SpyHunter to detect and prevent malicious software.
5. Educate Yourself and Employees: Participate in cybersecurity awareness training to recognize phishing attempts and other social engineering tactics.
6. Regularly Update Passwords: Change your passwords periodically and avoid reusing them across multiple accounts.
7. Backup Data: Maintain regular backups of critical data to ensure recovery in case of malware attacks.