Debunking hoaxes and exposing scams since 2003!

Hoax-Slayer Logo

Fake Costco Order Notification Leads to Malware


Email purporting to be from Costco thanks you for your recent order and invites you to view order details by clicking a link.

© maxkabakov

Brief Analysis

The email is not from Costco. Clicking the link opens a website that contains malware. Once installed, this malware may collect personal information from your computer and connect with servers operated by criminals. If you receive this email, do not click any links or open any attachments that it contains.


Subject: Thank you for buying from Costco

Our online store received an order and the personal data of the recipient coincide with yours.
You may get your order in the nearest Local Store.
Attention! Your order can be reserved within 4 days.
You may see order details here .
Happy Thanksgiving Day!

Truly yours,


Detailed Analysis

Email Claims to Be Order Notification from Costco

According to this 'thank-you' email, which purports to be from Costco, the company has received your order and you may pick it up at a local store.

The email invites you to click a link to view details about the supposed order.

The message includes the Costco name logo and is designed to emulate a genuine email from the company.

Email is Not From Costco - Link Leads to Malware

However, the email is not from Costco and the link does not open information about an order.  Instead, the link opens a website that harbours malware.

Clicking the link automatically downloads a .zip file. In the sample I tested, the file was named File names may vary in different incarnations of the scam.

Opening the .zip file reveals a .exe file with a similar name. Clicking this .exe file will install the malware on your computer.

Typically, such malware can harvest sensitive information from the infected computer and send it to online criminals. It may also download and install further malware components and allow the criminals to control the computer from afar.

Fake Order Messages a Common Malware Ploy

Criminals often send out bogus order notifications as a means of tricking people into installing malware. The messages have used the names of many high profile companies.

Some versions include the malware in an attached file rather than on a compromised website.

If you receive one of these emails, do not click any links or open any attachments that it contains.

If you have an account with the store named in the email, it is safer to login by entering the address in your browser's address bar rather than by clicking a link.


© ileezhun

Last updated: November 28, 2014
First published: November 28, 2014
By Brett M. Christensen
About Hoax-Slayer

Amazon 'Order Details' Malware Email
MALWARE - Order Number 'Thank You For Using Our Services' Email
American Airlines Flight Ticket Order Malware Emails