Friday, 5 December 2014

XLS macro malware: K J Watking & Co

Looks like they've now switched to XLS (Excel) based macro malware instead of DOC (Word) based...

Various names from K J Watking & Co seems to be the company being used....

Four versions so far...
Detected as:

rogue.hdb: Sanesecurity.Rogue.0hr.20141205-0827
rogue.hdb: Sanesecurity.Rogue.0hr.20141205-0901
phish.ndb: Sanesecurity.Malware.24629.XlsHeur


Anonymous said...

I received the same email to my business email address at 8.30 this morning!

Steve H said...

Just received similar email from Claire Bradford, with BAC_901186F,els attached. Email from

Anonymous said...

there is actually a firm in the UK
KJ Watkin & Co "For bankruptcy and insolvency advice for individuals and businesses across the West Midlands contact insolvency practitioners".This fooled me a bit but I tried to phone them without success and then found this site.

Joe from Reading said...

I got two recently from Lolita Humphrey & Tommy Stuart both K J Watking & Co.

My junk filter caught them both.

steve yates said...

I have a business in France and have just received one with an attached .xls file from :

"Shon Wall
Senior Accounts Payable Specialist
K J Watking & Co
Tel: 01469 590124"

Didn't get picked up by my French ISP but it was in English so won't complain.

Anonymous said...

Received the same just now:

Please find attached a remittance advice for recent BACS payment.

Any queries please contact us.

Ramon Rush
Senior Accounts Payable Specialist
K J Watking & Co
Tel: 01469 482957

Phone doesn't work.

Anonymous said...

Just received one. Did not realise it was malware. Tried to phone - no use. Sent a reply asking for explanation. Has this compromised either my computer or bank?