Fake Microsoft security email hides Trojan

Fraudsters are sending out fake security bulletins that attempt to install malicious software on victims' computers, just ahead of Microsoft’s monthly security patch release.

Share

Fraudsters are sending out fake security bulletins that attempt to install malicious software on victims' computers, just ahead of Microsoft’s monthly security patch release.

The email messages claim to describe a "Cumulative Security Update for Internet Explorer" that fixes a critical security flaw in the browser. It comes with a link entitled "Download this update".

When users click on this link, they are taken to a server that attempts to install malicious software known as Trojan-Downloader.Win32.Agent.avk.

This Trojan software then attempts to reach out to other computers on the internet in order to install more programs on the victim's computer.

The Internet Storm Centre, set up by security research and education organisation SANS, received its first and only report of the scam on Thursday night but a second sample has also been posted to the Chinese Internet Security Response Team blog.

SANS volunteer Lenny Zeltser believes that the criminals behind this scam may be gearing up for more activity. He suspects the authors of the scam are planning to register new domains before embarking on a more widespread campaign.

The two email samples contained obvious errors that would be caught by technically savvy users. For example, although the patch Zeltser examined claimed to have been issued in June 2007, it was entitled MS06-4 instead of the more plausible MS07-004.

Still, these scams need to fool only a small percentage of victims in order to be successful. Zeltser asked: "Does it really matter that there are these strange discrepancies in the way the fake security alert is written? People who would notice probably would be the kind of people who wouldn't click on the link."

It is worth remembering that Microsoft does send out a notification e-mail when it publishes security bulletins, but the links in these alerts take users to the bulletins themselves, not to executable downloads.

Find your next job with computerworld UK jobs