How would someone know to email a hacking attempt to an unpublished email address?

[mahina]

I received an email that looked like it came from an employee where I work asking how to change his banking details for autodeposited payroll. It wasnʻt from him, which I only found out a couple of days later when I clicked on the sender after a baffling conversation with the person that I thought had written to me.

The first weird thing is that it was sent to (my name)@(our work url).com

We donʻt use those addresses. We never finalized them after signing up for them on our site…somewhere.

How would someone who found that to even use? Would they have used AI to search?

The company is very small and this seems like a lot of effort. But it is quite alarming because I thought it was from the real person.

Thanks you folks

[SheltieLover]

1. Dunno but alert your IT Security team rfn!

[mahina]

4. Would that I had one!

[SheltieLover]

7. Omg

[Nittersing]

2. Yikes!!

This is all gonna get much worse with AI, isn't it?

[canetoad]

3. The employee

Most likely has an infection on their computer - an email worm or trojan.

This piece of malicious software trawls through address books on the users computer, finding email addresses stored there. Then it replicates and sends itself out to the addresses found.

Best thing to do is let your colleague know that they need to do a full scan of their computer.

[mikeysnot]

5. It could have also been gleaned from

from another users computer that they sent email to.

[bucolic_frolic]

6. Sounds like someone hacked into your company's website

perhaps the employee portion. If the company is very small, I doubt AI would even know about it.

Your boss, the company's IT security, need to be notified pronto.