I don't use Firefox, but I also don't delete it from my installations, in case I ever want/need a second browser for some reason. And although I'd changed the default browser on my Xfce laptop to Vivaldi, it's possible that the change wasn't in effect for Thunderbird yet, because when I clicked on a routine email that contained links to news articles (all expected) Thunderbird launched Firefox instead of Vivaldi, and that when the problems started.
Several windows were opened, purportedly from Macafee, telling me that there are 5 Linux viruses on my system, and I needed to subscribe to Macafee right away to get rid of them. Naturally, I didn't click to subscribe, didn't provide any credit card information, or anything like that, and I used eopkg to remove Firefox, deleted three messages with a spurious "from" address from my inbox, and I'm pretty sure that laptop is cleaned up now.
But in the process, it emptied my inbox history. I use IMAP email, so those messages were deleted from the email server, and I won't see them again. Fortunately, the phishing scheme didn't know about all the other folders that my incoming emails are automatically moved to by inbox rules. So none of those were affected. What was in my inbox were just emails that aren't important to copy to another folder, so it's no big deal.
I was hesitant to send this message, because I don't want to alarm a bunch of Firefox users here, but I also don't want to see a lot of you getting your inboxes (Thunderbird) cleaned out by such a scheme. I'm not sure what to tell you to look out for, because the email I clicked on was an innocent one from a source I get news articles from every morning. I clicked on one of those articles, causing Thunderbird to launch Firefox, and that's when the trouble started. So I didn't see it as an email from Macafee, or I would have been suspicious, and would not have opened it.
About all I can suggest is that you're very careful clicking on any link that might cause Firefox to be launched. If anyone has further advice or you've been hit by this thing, let us know. As I said, I've removed Firefox from my Xfce laptop, and checked to be sure that Thunderbird is properly launching Vivaldi now, but for now, that's about all I can tell you.
