Sophos is intercepting a large number of malicious emails that have been spammed out around the world, posing as a new settings files for internet users' email systems. However, attached to the emails is a Trojan horse.
Each email is carefully disguised in an attempt to lure the recipient into believing they are genuine. For instance, they use the recipient's email address in the subject line and pretend to come from the support team at the recipient's email domain:
A typical malicious email reads as follows (I'm assuming the user's email address is username@example.com below):
Subject: A new settings file for the username@example.com has just be released
Attached file: settings.zip
Message body:
Dear use of the example.com mailing service!We are informing you that because of the security upgrade of the mailing service your mailbox username@example.com settings were changed. In order to apply the new set of settings open zip attached file.
Best regards, example.com Technical Support.
Although the hackers behind this attack have clearly put a little thought into how they might infect as many people as possible, they have made some grammatical mistakes which may tip off potential victims that the emails are not genuine.
For instance, the subject line of
A new settings file for the username@example.com has just be released
is very clumsy.
Attached to each email is a file called settings.zip, which contains a copy of the Troj/Bredo-BE Trojan horse.
Stay on your guard against attacks arriving via email. Although we see many web-based attacks these days, the rumours of the death of email-based malware are greatly exaggerated.
