Now many readers would assume that because my wife hears about yours truly having to deal with clients who almost get scammed or do get scammed, that my wife would be well equipped to avoid scams. And to be fair, she’s likely better equipped than most. The fact that she was led to the discovery of a new 407 ETR scam that is clearly active.
Last night my wife asked me if I had taken the 407 ETR recently. Now for those who don’t live in Ontario. The 407 ETR is a toll road that runs across the greater Toronto area from Burlington in the west to Clarington in the east. I sometimes take it if I want to avoid traffic on Highway 401 and if it is convenient to do so. But it isn’t an everyday occurrence. Now when I do take it, I try to dump some money into our 407 account to make sure that she doesn’t have to pay for anything. But I will admit that I am not consistent about doing that. Which is likely why she asked about this.
Now when she told me the dollar amount that was owing, that was a red flag for me. It was $9.95. There’s only two or three clients that I would contemplate using the 407 ETR to get to or from their location. And any of those locations would be $20 or more in tolls and associated fees. That’s when I asked her to show me the email and I saw this:
Now this is a very, very convincing email that would make you think that this was legitimate. But it isn’t. Here’s why:
- There is no mention of my wife’s name or account number. That’s a #fail because companies who send you bills will always refer to you by name or account number.
- Looking closely at the sent address and recipient address, I see this:
The to address was sent directly to my wife’s email account. But the reply to didn’t come from the organization that runs the 407 ETR as that would have ended in @407etr.com. Next, if you look at the “from” field, you see this.
This is clearly not from the organization that runs the 407 ETR. Plus, if you look at the link that is referenced in the email, you get this:
The real 407 ETR website is http://www.407etr.com. Thus highlighting that this is a scam email.
Now my wife did not click on any links, but as a precaution we changed the password that’s associated with the account to keep the account safe. But I did go to the link and found a page which was clearly created to steal your credit card details. And on top of that, it looks like the same threat actors sent her two additional emails with different dollar amounts over the last two weeks. I find that interesting because this campaign seems hyper targeted. Perhaps it is related to this data breach from 2020? Who knows. But my wife took the right actions and avoided falling for this scam. Which are not to click anything and question everything. And I am doing my part by putting this story out there so you don’t fall for this scam either seeing as it is clearly an active campaign.
Forcepoint X-Labs Uncovers Low-Noise Phorpiex Campaign Delivering Offline ‘Global Group’ Ransomware
Posted in Commentary with tags Forcepoint X-Labs on February 9, 2026 by itnerdToday, the researchers at Forcepoint X-Labs released findings on a high-volume phishing campaign leveraging the Phorpiex botnet to deliver Global Group ransomware, demonstrating how familiar file types and low-friction attack chains continue to enable high-impact compromises.
Authored by Lydia McElligott, Senior Security Researcher, Forcepoint X-Labs researchers observed the following:
Bigger Picture
This campaign highlights how long-standing malware families remain effective when paired with reliable phishing techniques, reinforcing the need for organizations to prioritize endpoint behavior monitoring rather than relying solely on network signals.
Here’s a link to the full findings: https://www.forcepoint.com/blog/x-labs/phorpiex-global-group-ransomware-lnk-phishing.
Leave a comment »