Fake FCI Exchange report emails carry malware infection

Filed Under: Featured, Malware, Spam

SophosLabs is intercepting a large number of malicious emails that have been spammed out across the internet.

The emails, which use a variety of subject lines, refer to selling real estate notes and claim to come from a firm called FCI Exchange.

Here's a typical example:

FCI email malware attack

Hello,

We wanted to let you know that FCI Exchange, The Nation's Leading Note
Trading Platform is searching for real estate note owners interested in selling.

For additional Information refer to attched FCI Exchange Report

Remember FCI Exchange has thousands of buyers ready to act and
there are no charges until a note is purchased. We look forward to
working with you.

Subject lines used in the malicious email campaign include:

We sell Real Estate notes
Performing Notes Wanted
RE notes wanted

Attached to the emails is a ZIP file (typically called FCI_Exchange_Report_[random number].zip) which contains a malicious file designed to infect Windows computers.

Sophos security products are being updated to detect the malware as Troj/Dorkbot-BL (the emails are already being intercepted as spam).

Please remember to keep your wits about you, and never open unsolicited email attachments - it could be designed to infect your computer.

, , ,

You might like

One Response to Fake FCI Exchange report emails carry malware infection

  1. bob · 930 days ago

    Something new today on wifes email went out to her address book, simply says 'Hi' on subject. She received no address daemons back-maybe erases addresses? Don't know yet, her cousin called to warn from Florida, who unfortunately opened it which says something about working from home. 10:30 Pacific Time

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley runs his own award-winning computer security blog, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Send Graham an email, subscribe to his updates on Facebook, follow him on Twitter and App.net, and circle him on Google Plus for regular updates.