Blackhole malware attack spread via 'Your photos' email

Filed Under: Featured, Internet Explorer, Malware, Spam, Vulnerability

Blackhole photo. Image from ShutterstockA malware attack has been spammed out widely via email to internet users, posing as a message about photos.

In the attack, cybercriminals attempt to trick unsuspecting users into opening an attached file in their browser, redirecting them to a webpage hosted on a Russian website that takes advantage of the Blackhole exploit kit.

The notorious Blackhole exploit kit then attempts to infect visiting computers through a wide number of vulnerabilities.

Here's a typical message that has been spammed out - in this case, pretending to come from a LinkedIn user:

Malicious email

Subject: Your Photos

Message body:
I have attached your photos to the mail (Open with Internet Explorer)

The attached file has a name of Image_DIG[random number].htm. If you make the mistake of opening the file attachment in your web browser you will see a "please wait" message:

Please wait a moment. You will be forwarded..

Internet Explorer or Mozilla Firefox compatible only


Sophos detects this HTML file proactively as Mal/JSRedir-M. What isn't obvious to most computer users is that behind-the-scenes obfuscated JavaScript code is redirecting the user's browser to a Blackhole exploit site.

Obfuscated JavaScript code

More and more of the attacks that the folks at SophosLabs are intercepting involve the Blackhole exploit kit, underlining the importance of keeping your computer's anti-virus software and software patches up-to-date as well as learning to exercise caution about opening unsolicited attachments or clicking on unknown links.

Learn more: Exploring the Blackhole exploit kit

Black hole illustration image from Shutterstock.

, , , ,

You might like

2 Responses to Blackhole malware attack spread via 'Your photos' email

  1. Andrew Covarrubias · 1039 days ago

    This seems a bit more obvious than some. Attaching what purports to be photos, and then explicitly saying to open them in a web browser rather than a photo editor? That'd set off some warning alarms in my head right away.

    Then again, studies have shown that users like following directions, however arbitrary they may be. A key part of saying "Open with Internet Explorer" is the word "open". Users may see this, and be more likely to open it at all simply because the email said to. Google AdWords doesn't allow ads that say "click here" for this very reason. That being said, I think this was an unintended side-effect, rather than the intention.

  2. kstaxman · 1038 days ago

    The most important thing to realize about this as with all other email attacks is to ALWAYS doubt every email you receive. These attacks rely on you doing something without thinking. So doubt everything and check BEFORE you take any action that can compromise your computers security.

    So when that popup comes up saying your infected... doubt it... don't just click on it!

    When that email says you have pictures or anything else that you need to go someplace else to see or download... doubt it... don't just do as you're told and download a file or go to a site you're not sure of!

    All of these types of attacks require you to act before you think... so make a conscious effort to change the natural instinct of acting first and thinking later.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley runs his own award-winning computer security blog at, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Follow him on Twitter at @gcluley