Thailand Pass Email Hacked

from

From Gay Guides Forum. posted by daydreamer Tuesday Feb 15

https://www.gayguides.com/forums/top...ge/7/#comments

On 1/28/2022 at 6:33 AM, reader said:
WARNING: It looks like the Thailand Pass email database has been hacked and is sending out spoof emails with a link that sends people to a malware site after they click on “download”. Everyone is getting the same QR Code for a Mr Hongkam. Please share this news with others


Just this evening, I received a second one of these fake emails with a PDF file attachment, that if opened, no doubt contains malware. I'm copying the text of the email below. It is sent from contact@passthailandteam

I deleted the .com extension from the above email address so nobody will accidentally click on it as a link. If you receive one of these spoof emails, do not open it.

I left Thailand more than one week ago, but the hackers don't know that. Beware. Here is the text from the email:



There are problems with your information. You can access and download your Thailand Pass QR Code by double clicking the attached PDF

Travelling to Thailand

1. Please prepare your documents to present at the check-in counter and to the agencies concerned when arriving in Thailand. The documents are as follows
1.1 Passport with visa (if required)
1.2 Thailand Pass QR Code (on mobile device or printed copy)
1.3 Medical certificate with a laboratory result indicating that COVID-19 is not detected through RT-PCR test (issued within 72 hours before departure). If the Port Health and Quarantine at airports in Thailand discover that you have invalidated COVID-19 RT-PCR test result or if the type of the test is not RT-PCR method, you will not be eligible to be exempted from quarantine, but you may be allowed to enter Thailand by quarantine only.
2. When arriving in Thailand, please present your documents and Thailand Pass QR Code to the immigration and disease control officers.

Download the attachment PDF and update the information

The Thailand Pass email system is still sending out emails with fake attachments?

Thanks dab69 for copying my post from the Gay Guides Forum here. It helps spread the word, and hopefully will save someone from downloading malware on their device.

I have just posted another response on the Gay Guides Forum about the Thailand Pass. I'll copy it below:

----------------------------------------------------------------------------------------------------------------------------------------------------------



Q. daydreamer, are you saying that all Thai Pass approvals are fake? How can anyone know if their Thai Pass approval is official or not?


A. Not all Thailand Pass approvals are fake. If you receive an email about your Thailand Pass, please note where it is coming from before opening any attachments.

Any emails coming from contact@passthailandteam ( .com) are fake. The correct domain address for Thailand Pass is @tp.consular.go.th .

Also note that the genuine Thai government address ends in .go.th and not .com



This information is also on a pop-up on the genuine Thailand Pass website at https://tp.consular.go.th/

I am posting a screenshot below. I added the blue arrow to make it easier to find the applicable text.

As is often the case, a look at the sender's email address reveals it as scam. The address is similar at first glance, but in such cases one should look closely to spot the difference.

This is the e-mail hackers are currently using:
support@informationthailandpass.com

Received one threat mail today.