Spammer's blunder leads to widespread split personality malware attack

We're seeing a widespread malware attack in our spam traps this morning - and what's making it unusual is that it appears not to be able to decide what it is.

When you first see the subject line, you imagine it's going to be another "undelivered parcel" attack:

United Parcel Service notification #49674

(the tracking number changes in each email)

And the fact that it uses an @ups.com email address doesn't do anything to make you think it won't be another addition to the long line of malware attacks that are spammed out pretending to come from the likes of UPS, FedEx or DHL.

Things get a little weird, however, when you look at the email's content.

The message, embedded as an image inside the email, claims to come from the Federal Deposit Insurance Corporation (FDIC).

It claims that there are "important changes in current regulations of endowment insurance procedure" that you should look through, and is signed - with "best regards" from the "Federal Deposit Insurance Corporation Investors Relations Department".

What a strange email!

On one hand it claims to be from UPS about a delivery, and with a split personality it then claims to be a message from FDIC! The attached file appears to keep up the pretence of being FDIC-related - it's called FDIC_Document.zip.

Beware opening the ZIP file, however. It contains a malicious file called FDIC_Document.exe. Sophos has added detection of the malware as Troj/Bredo-FA.

This malicious spam campaign is widespread right now, hitting inboxes around the world. Hopefully the cybercriminal's botched job will stop some people opening the attachment as its subject line and 'from' address is clearly so out of kilter with its email body.

But no doubt there are some folks who will be so puzzled by this email's split personality that they'll investigate the attached file, and end up with an infected Windows computer.

15 February 2010 Update: It looks like the bad guys have now realised their mistake, as we're seeing malicious messages using a "correct" FDIC-related subject line and the embedded image claiming to come from FDIC:

Subject: Important information for depositors of Federal Deposit Insurance Corporation #76367

(the number is still randomly chosen)

Take care folks!