Fake Microsoft Security Alerts

Here's one you want to share with friends and family. Scammers are sending emails with phony Microsoft security alerts. If you execute the file that is attached, your computer is infected with a trojan downloader.

With Microsoft Corp.'s monthly patch release expected on Tuesday, scammers are sending out fake security bulletins that attempt to install malicious software on victim's computers.

The e-mail messages claim to describe a "Cumulative Security Update for Internet Explorer" that fixes a critical security flaw in the browser. It comes with a link entitled "Download this update."

When users click on this link, they are taken to a server that attempts to install malicious software known as Trojan-Downloader.Win32.Agent.avk.

This Trojan software then attempts to reach out to other computers on the Internet in order to install more programs on the victim's computer.

The SANS Internet Storm Center received its first and only report of the scam on Thursday night but a second sample has also been posted to the Chinese Internet Security Response Team blog.

SANS volunteer Lenny Zeltser believes that the criminals behind this scam may be gearing up for more activity. The trojan looks for three different servers and two of them have domains that haven't yet been registered. He suspects the authors of the scam may be planning to register those domains before embarking on a more widespread campaign.

I personally do not get update emails from Microsoft, but apparently there are actual legitimate ones - but those take the person to a description page, not to an executable. I recommend managing your own updates or setting Windows to update automatically. But you might want to spread the word on this one.

categories Geek Stuff | Gaius Saturday, 9 June , 2007

Other Links to this Post

WordPress Themes