NEWS FROM THE LAB - Saturday, January 30, 2010

Texaco Offers You a Job For �8500 a Month Posted by Mikko @ 17:04 GMT

Online criminals need people to move their money so they themselves don't get caught. We call these Money Mules.

Most money mules recruitment is done in the name of a fictitious company, but sometimes the scammers simply lift a well-known brand.

Here's an example of a recent money-mule ad that has been spammed around in the name of Texaco, the oil company:


The e-mail originated from an IP address in Lagos, Nigeria. I guess Texaco must be doing some drilling over there.

The PDF contains no exploits and looks like this:


The text reads, in part:

  Texaco/Chevron Downstream Europe
  1 Westferry Circus Canary Wharf
  London E14 4HA

Dear Job Candidate,

The TEXACO Online Employment System wish to inform you that your posted
information onlinehas been carefully and confidentially reviewed by our
Recruitment Team Professionals and we have considered under our current
vacant opportunities within the Firm to employ you for work in our company.

TEXACO Online Employment System is affiliated to various job recruitment
websites and your information was submitted to us by our online agent that
submit job candidate resumes for consideration of employment depending on
the vacancies we have in any branch of TEXACO Company Worldwide.

As regards to this, you have been automatically granted this employment to
work in TEXACO Oil & Gas Field with a monthly salary of Eight Thousand
Five Hundred Pounds (�8,500).

Kindly acknowledge the content of this message by reconfirming your interest
in working for us and indicating your area of job interest, ensuring that you
have quoted your vacancy title below or send your CV with a covering letter.

For further details relating to your employment, kindly send an email to
Texaco/Chevron Downstream Europe H/R Recruitment Service Department
texaco@post.com / http://texaco.us.ms / http://texaco.com/portal_default.asp/.

  Paul Matins
  HR Recruitment Manager

Do note the suspicious contact information like texaco@post.com and http://texaco.us.ms. Top-level domain .ms belongs to a small Caribbean nation called Montserrat.

The website at texaco.us.ms looks like this:


Don't apply… although the salary looks good and you get to name your own area of job interest, I'm sure your job would include picking up cash and wiring it to far-away places with Webmoney, Western Union and Fethard Finance.