eMail "watcher" and "reporter" "Phishing relays"

[normjr_kofc894]

- A little over a year ago, I was having trouble with someone in my fraternal organization, and I began noticing that after eMail "conversations" with him, I began getting bombarded with Phishing scams. I reported several to the FBI's IC3 site and they stopped for a brief time. I ended up blocking ALL of this person's eMail accounts. The Phishing stopped. That was a year ago.
- Recently, I was compelled / required to resume communications with this person again. The Phishing resumed. This time to a different account associated with that fraternal group (There several accounts). Again I reported to IC3, the "Amazon" scams stopped and several others began. I have been reporting to IC3 from an entirely different account on a different machine.
- All of my "fraternal" accounts are accessed through one and only one machine. This "fraternal" machine is the only machine on my network affected by the scams, and the only one that I have reputedly communicated with the gentleman, all of his accounts on all other machines are blocked.
- I am not the only one affected, other members get the scams, they just delete the scams, "blow them off" and keep on going, never reporting them.

Here are the questions.
1.Is / are there any pieces of malware that "hide" on a machine undetected by most AV scanners, monitor the eMail activity and transmit eMail addresses back to the "Phisher"?
2. Do the names of any such malware come to mind. Please keep in mind that by now, this has been on his machine for over a year.

[Asyn]

Maybe he was hacked..!? Avast Hack-Check: https://www.avast.com/hackcheck

[normjr_kofc894]

Thank you Asyn- This is what I was thinking.
- I am thinking that he's been hacked and that some sort of malware that monitors his eMail traffic and sends the eMail addresses back to the hacker who in turn sends out the phishing messages.
- Do you know if the Avast Rescue Disk would find something like this?
- I do know that some of these attacks are getting pretty sophisticated.

[Asyn]

Do you know if the Avast Rescue Disk would find something like this?

If malware is involved, it's worth a try. But he would need to change all passwords anyway.

[Pondus]

something he may try:

Malwarebytes, see instructions in step #1 here  >> https://forum.avast.com/index.php?topic=194892.0

Online scanners, no install you just download a small client to run it

Trend Micro Housecall  >>  https://www.trendmicro.com/en_us/forHome/products/housecall.html

F-Secure  >>  https://www.f-secure.com/en/home/free-tools/online-scanner