A clever new form of social engineering spam has started circulating today. It's a new attempt by scammers to trick their victims into downloading malware onto their computers.
The scammers use names from various well-known security companies to make the email that the end user receives seem more believable. Their goal, as mentioned above, is to install malware on the victim's computer, which comes with an attached patch file of a supposedly urgent security software update.
Symantec has documented some of the message topics:
- AntiVir Desktop: Important System Update – requires immediate action
- Avast Antivirus: Important System Update – requires immediate action
- AVG Anti-Virus Free Edition: Important System Update – requires immediate action
- Avira Desktop: Important System Update – requires immediate action
- Baidu Antivirus: Important System Update – requires immediate action
- Cloud Antivirus Firewall: Important System Update – requires immediate action
- ESET NOD32 Antivirus: Important System Update – requires immediate action
- Kaspersky Anti-Virus: Important System Update – requires immediate action
- McAfee Personal Firewall: Important System Update – requires immediate action
- Norton AntiVirus: Important System Update – requires immediate action
- Norton Internet Security: Important System Update – requires immediate action
- Norton 360: Important System Update – requires immediate action
- Symantec Endpoint Protection: Important System Update – requires immediate action
- Trend Micro Titanium Internet Security: Important System Update – requires immediate action
Although the subject changes, the attached zip file containing the malware is the same.
Once the malware is executed, it connects to the address [https://] networksecurityx.hopto.org to download another file.
If you see any of these emails, stay away. Of course, you should always be suspicious if there are attachments from recipients you don't know.
