Fake PayPal payment notification leads to malware
Posted on 02.05.2012
PayPal might have passed the torch of the most phished brand to China’s Taobao.com, but that doesn't mean that phishers and other scammers have stopped delivering emails supposedly sent by the e-commerce giant.

A new spam campaign misusing PayPal's name and bearing the panic-inducing subject line of "FW: You just sent a payment to [random name]" has been spotted yesterday:


"The criminals believe (and from what we've seen, correctly) that when presented with the news that you just sent $100 to someone from your Paypal account, you will have a panic reaction and click on the link in the email. This is what they are counting on," says Gary Warner.

All the links offered in the email are designed to make the recipients land on a website hosting two javascripts that redirect them to another site hosting an exploit kit.

While the users are reassured by the "Please wait page is loading…" sign, the exploit kit drops a Java file that takes advantage of a vulnerability and drops and installs an executable on the targets' computer.

Initially, only five of the AV solutions used by VirusTotal detected the executable as malware, but the number has now jumped to 17.

It is still unknown what kind of malware it actually is because the different solutions detect it as the Zeus Trojan, a backdoor or a dropper Trojan, but you can be sure it is not good news.

This spam campaign has only started yesterday, but is practically a copy of an earlier one misusing the LinkedIn brand and posing as a notification reminder.






Spotlight

Infographic: 25 years of the firewall

Posted on 24 July 2014.  |  The firewall turned 25, and McAfee is celebrating with an infographic that creatively depicts its lifetime. If you take a moment to scan the infographic, you’ll notice the firewall's introduction and evolution coincide with certain security events.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Jul 25th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //