Federal Reserve spam attack emerges

Malware scam warns of phishing scam

Written by Shaun Nichols in San Francisco

 November 14,  2008

Security officials are warning users of a clever new phishing scam arriving in emails purporting to come from the US Federal Reserve.

The US Computer Emergency Response Team (US-CERT) said that the spammed messages direct users to a web page which warns of a new phishing scam targeting users.

The message contains a fake Federal Reserve letterhead and warns users in typically broken English that a "large-scales phishing attack started and has been still lasting".

In addition to the shoddy grammar, the messages are identifiable in their attempt to lure victims to an outside URL.

On clicking the link, the user is briefly sent to a fake Federal Reserve page which attempts to download a PDF file, supposedly containing further details on the attack. Shortly after accessing the page, the user is forwarded to a pornographic web site.

Joey Costoya, advanced threats researcher at security firm Trend Micro, said in a blog posting that the PDF file is loaded with malicious JavaScript which attempts to download and install a number of malware packages, including a botnet controller.

Costoya noted that the botnet uses a Secure Socket Layer connection to send and receive encrypted information between the botnet server and infected machines, a particularly interesting characteristic.

"This is certainly an improvement over the web-based bots of old, where traffic [is] seen in plain text," he explained. "Makes one wonder what else the bad guys have in store for us."

In addition to keeping updated system and antivirus software, US-CERT recommends that users exercise caution when viewing unsolicited messages and avoid clicking on any links which may seem suspicious.

Courtesy of vnunet.com