FedEx e-Order Virus

The FedEx e-Order Notification email virus is a fake delivery or billing message that tries to make you open an attached Excel file. If you only received the email, do not open the attachment, do not reply, and verify any shipment from the official FedEx site or app. If you opened the XLS file or enabled editing, disconnect the PC from the network, keep the email and file for evidence, scan Windows, and change important passwords from a clean device.

This campaign works because it looks like routine shipping paperwork: an air waybill, tax bill, receipt, or payment document. The danger is not the FedEx name by itself. The danger is the unexpected spreadsheet and any prompt that asks you to enable editing, enable content, enter credentials, or install something to view the order.

What Is the FedEx e-Order Notification Email Virus?

It is a phishing and malware-delivery lure that impersonates FedEx and uses business-document wording to make the attachment feel normal. The file name may include terms such as fedex_awb, tax_bill, document, receipt, or payment, followed by dates or random numbers. Attackers change names often, so treat the subject, sender, attachment, and pressure tactics together instead of trusting a single indicator.

FedEx warns that fraudulent emails can be disguised as delivery notices and may include attachments that contain malware. FedEx also says it does not request payment or personal information through unsolicited email, mail, text, or calls for goods in transit or in its custody [1]. That is the key rule for this lure: a message that appears from FedEx but pushes an unexpected spreadsheet should be handled as suspicious until verified through a separate official channel.

If You Received the Email but Did Not Open the XLS

1. Do not open the attachment and do not click links inside the message.
2. Do not reply, call numbers from the email, or send account, identity, card, invoice, or login details.
3. Check the shipment only by typing fedex.com manually or using the official FedEx app.
4. Forward or report the suspicious message through your email provider and FedEx fraud reporting flow.
5. Delete the email after reporting it, or keep it in a safe mailbox folder if your workplace IT team needs the original headers.

If you are unsure whether the message is a delivery scam or a real shipment notice, compare it against the red flags in our phishing email checklist. Delivery brands are common bait because many people are waiting for packages and may open paperwork quickly.

If You Opened the Excel Attachment

Opening the file is not always the same as infection. Modern Office versions may open internet-sourced files in Protected View, which reduces risk while the document is read-only [2]. The risk increases if you clicked Enable Editing, Enable Content, bypassed a macro warning, entered credentials, downloaded another file, or saw command windows, browser tabs, or security alerts afterward.

1. Disconnect the computer from Wi-Fi or Ethernet if you enabled editing/content or saw unusual activity.
2. Do not log in to email, banking, work portals, crypto wallets, or password managers from that computer.
3. Save the email headers and attachment name for your IT team or incident notes. Do not forward the attachment to coworkers.
4. Move the attachment out of Downloads/Desktop into a quarantine folder only if you know what you are doing; otherwise leave it and scan the system.
5. Run a full antivirus scan and a second-opinion malware scan. Use Gridinsoft Anti-Malware to check for loaders, stealers, suspicious startup entries, and leftover payloads.
6. Check recent Downloads, Temp, Startup, Task Scheduler, and browser extension changes if the scan finds anything or the machine behaves oddly.
7. Change passwords from a clean phone or another trusted computer if you typed credentials, enabled content, or suspect stealer activity.

Microsoft documents macro malware as a common email-attachment delivery method, and Office blocks macros from internet-sourced files by default in supported configurations [3]. That protection helps, but it is not a reason to trust a suspicious workbook. Attackers can use old file formats, password-protected archives, embedded links, fake instructions, or social pressure to make users bypass security prompts.

Windows Checks After a Suspicious FedEx XLS

After scanning, look for signs that the workbook triggered a second-stage payload or credential theft. The most important clues are recent files and persistence points created around the time you opened the attachment.

• Downloads and Temp: look for new executables, scripts, archives, or documents created immediately after opening the spreadsheet.
• Startup apps: open Task Manager, check the Startup apps tab, and disable unknown entries until they can be identified.
• Task Scheduler: review tasks created today, especially ones launching PowerShell, wscript.exe, mshta.exe, rundll32.exe, or files from AppData/Temp.
• Browser sessions: sign out of email, shopping, shipping, banking, and social accounts if the machine may have been compromised.
• Security history: check Windows Security or your antivirus history for blocked scripts, Trojan detections, suspicious outbound connections, or quarantined Office payloads.

If the suspicious email led to a download, fake invoice portal, or credential prompt, treat it like a phishing incident as well as a malware incident. Our infostealer recovery guide explains the password, session, and account-reset sequence that also applies when a malicious document may have run code.

How to Verify a Real FedEx Shipment Safely

A real tracking problem can exist at the same time as a scam email. Verify it without using the message itself.

1. Open a new browser tab and type fedex.com manually.
2. Paste the tracking number only if you already expected the package or received it from the merchant through a trusted order page.
3. Use your retailer’s order history rather than the email link when possible.
4. Call FedEx only from a phone number on the official website, not from the suspicious email.
5. For unexpected delivery-fee, tax, or address-correction messages, compare the wording with common delivery scam patterns, including fake USPS and courier notices.

For package-themed scams that arrive by SMS rather than email, see our USPS delivery scam guide. The brands differ, but the pressure pattern is similar: urgent delivery problem, a link or attachment, and a request that moves the victim outside a trusted order flow.

What Not to Do

• Do not enable macros, editing, or content because the spreadsheet says the document is protected.
• Do not remove Office security warnings to make a suspicious file work.
• Do not upload the attachment to public forums with your email headers or customer details visible.
• Do not pay a delivery fee, customs fee, or invoice from a link in the message.
• Do not reset passwords from the same PC if you believe the attachment ran malware.

FAQ

References

1. FedEx. “How to Recognize and Help Prevent Fraud and Scams.” FedEx, accessed June 5, 2026. https://www.fedex.com/en-us/report-fraud.html
2. Microsoft Support. “What is Protected View?” Microsoft, accessed June 5, 2026. https://support.microsoft.com/en-us/office/what-is-protected-view-d6f09ac7-e6b9-4495-8e43-2bbcdbcb6653
3. Microsoft Learn. “Macros from the internet are blocked by default in Office.” Microsoft, updated April 18, 2025, accessed June 5, 2026. https://learn.microsoft.com/en-us/deployoffice/security/internet-macros-blocked