Sly Spam Run Targets Hotmail Users

[Peaches]

Jul30 2009

Sly Spam Run Targets Hotmail Users

by JM Hipolito (Technical Communications)

Hotmail users need to be wary about a malicious spam run that specifically targets users of the said webmail.

Senior Security Analyst Rik Ferguson reports that spam messages arrive with text indicating that it has file attachments that are image files with the JPEG format. In truth however, the file names of attachments are actually links that connect to shortened URLs, which in turn connect to malicious URLs.

Connecting to the malicious URLs, which are now blocked, leads to the download of the malicious file fotos.com which is now detected as TROJ_DLOADR.AQJ. The said file, in turn, downloads a wide variety of information-stealing malware. The malicious URLs and files are all blocked through the Trend Micro Smart Protection Network.

Quite noteworthy is the fact that the links were crafted to, at first glance, look very similar to how file attachments are displayed in most emails. An envelope-shaped icon is even seen at the side of each of the links, which is typical for file attachments.

However, there are also noticeable differences between such spam email and a legitimate email message, which users must watch out for should they receive a suspicious email message.

Trendmicro for details & screenshots - http://blog.trendmicro.com/