Email and Internet content security provider Marshal (www.marshal.com) has identified a new outbreak of malicious spam emails that use login account confirmation details as a hook to get email users to visit an infected web site.
According to the Marshal TRACE team, the spam emails appear to come from a legitimate organization and provides recipients with temporary login confirmation details for a web site. The spam uses text like "for security purposes, please login and change the temporary Login ID and Password". The messages include a link to an IP address which is in fact a website infected with the Storm Trojan.
The messages appear to come from the technical support departments of a range of organizations with names designed to generate the interest of the broad public, such as "Joke-A-Day" and "Web Players". The links appear as an IP address rather than a more normal URL – e.g. http://213.161.89.20/
"We are seeing significant volumes of ‘confirmation spam’ hitting inboxes. This outbreak is the latest in a string of underhanded social engineering tactics used by the same individuals responsible for the Storm Trojan to propagate their botnet. These criminals are clever and highly adaptive. This is simply their latest attempt to fool unsuspecting email users into infecting themselves," said Bradley Anstis, Director of Product Management at Marshal.
The Storm Trojan first appeared in January 2007. It quickly gained success and notoriety by using the guise of current affairs headlines to fool unsuspecting recipients into clicking on a link which lead to the Trojan. Examples of the headlines used included, "Saddam Hussein alive!" and "Chinese missile shot down by USA aircraft". Since then the group of criminals behind the Storm Trojan have used the guise of greeting cards to infect computers with subjects ranging from the 4th of July to Thank You cards.
"The ‘confirmation spam’ outbreak has been launched by the same group that launched the Hot Pictures spam campaign earlier in the week. Previously these spam campaigns, like the greeting card campaign, would last for weeks at a time. Now however, spammers are modifying or launching new spam campaigns almost daily," commented Anstis.
"Our advice to anyone who receives a message like this from a person they do not know, or have not heard from for a long time is to delete it without opening it. Certainly, don’t click on the link in the message and don’t click "OK" if it asks to download a file," warned Anstis.
