Does this sound familiar? A phone call out of the blue from a former co-worker, alarmed about an e-mail she said you sent her—only you didn’t.

Janet, your former colleague, was clearly upset.  “I just got your email!Why are you sending me random links to these websites? I clicked the link and now my screen is filled with pop-ups that I can’t get rid of. I can’t use my browser at all anymore and now the IT guy has to come help. Why did you send me this?

Chances are you have no idea how this happened. Chances are you have received emails from yourself, or emails from contacts that you know they didn’t send. Chances are you are as confused as Janet about what happened, and worried that someone is impersonating you.

How does this happen?

While your gut reaction might tell you that you’ve been hacked, it might not actually be the case. If you were hacked, this means that someone figured out your email and password and logged in to send spam or malicious attachments and links to your stored contacts. Contrary to popular belief, this doesn’t actually happen all that often. While it’s a very real possibility, chances are it could be the result of a virus that one of your contacts has. And you may not be infected with the virus at all!

Viruses used to collect contacts typically originate as a phishing attack containing a malicious file or link. If the virus bypasses your security controls, it could collect the contents of your address book and send itself to each of the harvested addresses. The virus doesn’t actually use your own email client to send itself, so it isn’t truly coming from you.

It’s Not Always a Virus

Sometimes, a virus isn’t the route spammers and criminals use to get into your inbox. Even if you have the strictest virus controls, if your email address or domain is whitelisted, you could be vulnerable to seeing spam messages in your own name pop up in your inbox. While whitelisting your domain might seem like a good idea at first so that your coworker’s emails don’t get caught up in your spam filters, it also gives the hackers a way in. If they use email spoofing to appear as you or someone in your organization, it could sail through your spam filters as requested.

How does email spoofing work? Learn more in our blog: How do I tell if this email is from who it says it is from?

Stopping the Spread

To prevent your own contact list being harvested, invest in security tools like anti-virus and web filtering to catch any malicious executables that you might accidently click on. These tools reduce your risk by using technical controls to block malicious URLs, IPs, and files before a connection is ever established or a file is downloaded.

If you want to ensure you’re completely safe, learn how to inspect malicious emails yourself and become security-aware. Make sure your human security filters are keen on the latest threats! Learn how to protect your organization.