Debunking hoaxes and exposing scams since 2003!

Jump To: Example    Detailed Analysis   Comments   References

Fake Ticketmaster Purchase Order Email Contains Malware

Jump To: Example    Detailed Analysis   Comments   References


Email purporting to be from large ticket sales and distribution company Ticketmaster thanks you for purchasing tickets and advises you to open an attached file to review order details.

Beware Malware

Brief Analysis

The email is not from Ticketmaster and the attachment does not contain ticket order details. In fact, the attached .zip file hides a dangerous executable file that, if opened, can install malware on your computer. The malware files attempt to masquerade as innocuous PDFs.



Bookmark and Share

related Links

Related Links

Identity theft is one of the fastest growing crimes in the world. Learn how to stay safe online with Hoax-Slayer's comprehensive eBook:


Subject: International Express-Ticketmaster Thank you for purchasing tickets on Ticketmaster.

Your order number for this purchase is 89-25628/AUS.Complete order detail is attached to this e-mail.

You will receive your tickets via: International Express-Ticketmaster will mail these within 2 business days of the booking. Tickets usually arrive within 10 working days of posting.

Total Charge: AU $121.80

Thank you for adding Event Ticket Insurance to your order. You will be billed AU $13.00 (AU $6.50 per ticket) separately.

Please note: for any ticket-related issues, please continue to contact Ticketmaster Customer Service.
Thanks again for using Ticketmaster.

Note: Email contains an attachment named: '

Detailed Analysis

'Ticketmaster' Email Claims to Contain Ticket Purchase Information

This email, which purports to be from ticket sales and distribution company, Ticketmaster, thanks you for your ticket purchase and advises that your tickets will be mailed within two business days.

The email quotes the price of the purchased tickets and claims that you can review details of the ticket order by opening an attached file.

Email is Not From Ticketmaster - Attachment Contains Malware

However, the email is not from Ticketmaster. It is an attempt by online criminals to trick you into installing malware on your computer.

The criminals hope that users will be panicked into opening the attached file because they think that their credit card has been fraudulently used to purchase expensive tickets.

If you open the attached .zip file, a malicious .exe or .pif file will be revealed. If you then open this file, malware will be installed on your computer.

The actual malware payload may vary. Typically, however, such malware can steal sensitive information such as passwords from your computer, download other types of malware, and allow criminals to control your computer from afar.

Details, such as the supposed cost of the tickets, may vary in different incarnations of the scam message.

Ticketmaster has warned customers about such scam emails via an entry on its FAQ.       

If you receive one of these fake Ticketmaster emails, do not open any attachments or click any links that it contains.

Malware Warning


Last updated: January 29, 2015
First published: January 29, 2015
By Brett M. Christensen
About Hoax-Slayer

Ticketmaster FAQ

More stories!

'Internet Capacity Warning' Phishing Scam
According to this email, which claims to be from the 'Support Department' at 'Information Technology Services', your internet capacity is 70% full and you therefore need to contact support to avoid problems.
Published: July 6, 2015

Kroger 'Free Coupons' Survey Scam
Message being distributed across Facebook claims that users can receive free coupons from American retailer Kroger just by sharing a message and visiting a third party website to claim their prize.
Published: June 16, 2015

Pointless Facebook Warning - Hackers Posting Insulting Messages or Sexual Content In Your Name
'Hacker' alert messages circulating on Facebook claim that, without your knowledge, hackers are posting insulting or sexual messages that appear to come from you onto your Facebook Timeline.
Published: June 3, 2015