Fake Zoho 'file shared with you' email for 'eTranzact Proposal.pdf' leads to password-stealing page on zohoapps.ru
MalwareTips describes a fake Zoho 'file shared with you' email for 'eTranzact Proposal.pdf' that leads to a password-stealing page on verify.zohoapps.ru. Zoho and eTranzact are impersonated, not the senders.
- First reported
- Reports
- 1
Source: malwaretips.com · published
What happened
In a report published 18 October 2026, MalwareTips describes a phishing email posing as a Zoho file-sharing notice for a document called "eTranzact Proposal.pdf". The notice gives a file size, urges the recipient to open the document through a viewing button and adds a seven-day expiry so it looks like an ordinary sharing limit. MalwareTips says the destination, verify.zohoapps.ru, is a counterfeit sign-in page that asks for email addresses and passwords, and that although the hostname contains Zoho's name, the registered domain zohoapps.ru is not evidence of Zoho ownership.
Zoho is being impersonated, and the reference to eTranzact does not mean that organisation sent the message or is involved. When MalwareTips checked, the destination returned a connection error, so a working credential form could not be inspected, and no malicious PDF payload is established: the filename is part of a password-phishing pitch.
How the scam works
The email doesn't rely on threats. It gives the recipient an ordinary office task: look at a proposal another organisation has supposedly shared. The PDF name provides a subject and the file size adds realism, but both can be typed into an email without any real document behind them. A copied company address or footer can strengthen the impression. The seven-day expiry adds gentle pressure; unlike a countdown of seconds, a week looks reasonable and fits a real sharing system.
MalwareTips notes that Zoho really does offer business file sharing with expiry dates and recipient checks, so those features alone don't prove fraud. What matters is the destination and whether a real sharing relationship exists. A genuine proposal normally has context: a request for pricing, a project discussion or an agreement that someone would send a document.
It advises confirming with the expected sender through an existing conversation or a number you already know, not through a reply address in the suspicious email. Because a colleague's account can be compromised, a second channel is worth using if the request looks unusual. Procurement teams should compare any proposal with the supplier record and treat new bank details inside a document separately.
Source
MalwareTips, "Zoho File Shared With You Email Scam: Fake ETranzact Proposal Login Trap" (published 18 October 2026).
Red flags
- An unexpected 'file shared with you' notice for a proposal you weren't expecting.
- A sign-in link on a domain that isn't the service's own, such as zohoapps.ru.
- A short expiry, such as seven days, encouraging you to open it soon.
- A login page that appears before you can view a document.
If you were targeted
- 1Don't sign in through the link; open Zoho by typing its address yourself if you use it.
- 2Confirm with the supposed sender using an existing conversation or a known phone number.
- 3If you entered a password, change it at once, turn on multi-factor authentication and check mailbox forwarding rules and recent sign-ins.
- 4Tell your IT or security team and report the email as phishing.
- 5Treat any later payment or bank-detail changes linked to the 'proposal' as suspect until verified.