According to researchers from Trend Micro, fake emails purporting to come from Allergan are circulating with the subject line "Medical Lab Results:MEFHNAO796MEFHNAO791" and inform recipients of the following:
"Following our telephone communication, please find attached information in response to your medical inquiry. I have been informed that you may contact them for assistance."
The attached file is actually a malicious file designed to exploit a vulnerability in Microsoft Office to execute a backdoor (BKDR_LIFTOH.AD). This backdoor "downloads" a variant of the well-known information-stealing Trojan ZeuS.
Experts note that it is unusual for the BKDR_LIFTOH malware to be distributed via spam. It is usually spread via social networking sites and instant messaging platforms.
Another similar campaign uses fake real estate emails to distribute malware. The messages are titled “Purchase Acknowledgement” and read: “We have acknowledged and confirmed your order for [product], as follows: Attached is the sales invoice.”
Another variant appears to show DENSO Manufacturing UK as the sender and presents an "invoice" for a purchase order.
All of these campaigns appear to be targeting users in the United Kingdom.
