Fake PayPal payment notification leads to malware
Posted on 02.05.2012
PayPal might have passed the torch of the most phished brand to China’s Taobao.com, but that doesn't mean that phishers and other scammers have stopped delivering emails supposedly sent by the e-commerce giant.

A new spam campaign misusing PayPal's name and bearing the panic-inducing subject line of "FW: You just sent a payment to [random name]" has been spotted yesterday:


"The criminals believe (and from what we've seen, correctly) that when presented with the news that you just sent $100 to someone from your Paypal account, you will have a panic reaction and click on the link in the email. This is what they are counting on," says Gary Warner.

All the links offered in the email are designed to make the recipients land on a website hosting two javascripts that redirect them to another site hosting an exploit kit.

While the users are reassured by the "Please wait page is loading…" sign, the exploit kit drops a Java file that takes advantage of a vulnerability and drops and installs an executable on the targets' computer.

Initially, only five of the AV solutions used by VirusTotal detected the executable as malware, but the number has now jumped to 17.

It is still unknown what kind of malware it actually is because the different solutions detect it as the Zeus Trojan, a backdoor or a dropper Trojan, but you can be sure it is not good news.

This spam campaign has only started yesterday, but is practically a copy of an earlier one misusing the LinkedIn brand and posing as a notification reminder.






Spotlight

Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Tue, Feb 9th
    COPYRIGHT 1998-2016 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //