Fake eBay Payment Request Emails Lead to Malware

[Peaches]

Fake eBay Payment Request Emails Lead to Malware

Attached HTML files redirect to malicious websites

A new email spam campaign spreads emails masquerading as payment requests coming from eBay. Users are lured into opening an attached HTML file which redirects them to a malware pushing website.

The rogue email messages have a subject of "Payment request from." This is most likely a spelling mistake, the spammers probably intending to write "payment request form." This is suggested by the fact that the attached HTML file is called form.html. There is no message contained in the body, but the "From" field is forged to appear as if the emails were sent from a [email protected] address.

"Of course it's a sneaky piece of social engineering on the behalf of the hackers. Many people would be tempted to open the attachment to find out what on earth the email is about. And opening the attachment (which Sophos detects as Troj/JSRedir-BV) redirects your web browser to a recently compromised webpage on a legitimate site infected with Mal/Iframe-Q," Graham Cluley, senior technology consultant at Sophos, writes.

story - http://news.softpedi...re-147466.shtml