Original URL: http://www.channelregister.co.uk/2007/11/21/targeted_email_attacks/
Beware of emails that mention you and your company by name and claim to be official communications from the US Department of Justice. They're phony and will attempt to install malware on your machine.
The emails, which claim to reference a complaint recently filed by a business associate, invite the recipient to click on an attachment that contains a nasty Trojan, two separate security firms, MessageLabs (http://www.messagelabs.com/) and Websense (http://www.websense.com/), are reporting.
The practice of trying to extract sensitive information by sending highly personalized emails is generally called spear phishing, and it's proved to be successful in the past.
In May, security researchers from SecureWorks reported that emails purporting to come from the Better Business Bureau duped 1,400 business managers into installing a post logger on their machines. The loggers siphoned sensitive information that passed through the victims' Internet Explorer browser, including social security numbers, account numbers, and data that normally would be securely cloaked behind SSL defenses.
Spear phishing emails are notable for their impeccable grammar and spelling, a characteristic that distinguishes them from many of the plain vanilla phishing scams out there. Other recent spear phishing campaigns have masqueraded as emails from the Federal Trade Commission.
According to Websense, none of the major anti-virus companies detect the Trojan included in the fake Justice Department emails. That's likely to change in the next 24 hours, if it hasn't already. ®
Will EV SSL stop phishing attacks? Probably not (29 February 2008)
http://www.channelregister.co.uk/2008/02/29/ev_ssl_doubts/
New Trojan preys on commercial banking customers (17 December 2007)
http://www.theregister.co.uk/2007/12/17/prg_bank_trojan/
Webroot taps UK-based email filtering firm (27 November 2007)
http://www.channelregister.co.uk/2007/11/27/webroot_saas_move/
UK punters lose faith in phished brands (26 November 2007)
http://www.channelregister.co.uk/2007/11/26/uk_phishing_survey/
Salesforce.com gone phishing (7 November 2007)
http://www.channelregister.co.uk/2007/11/07/salesforce_phishing_scam_customer_list/
Print beats net for fraud (29 October 2007)
http://www.channelregister.co.uk/2007/10/29/ftc_study/
US phishermen trawl UK waters (18 October 2007)
http://www.channelregister.co.uk/2007/10/18/phishing_trends/
Indian police academy hosts phishing site (9 October 2007)
http://www.channelregister.co.uk/2007/10/09/indian_police_academy_phishing/
Phishers bait hook with Verified by Visa scam (26 September 2007)
http://www.channelregister.co.uk/2007/09/26/verified_by_visa/
US phish feeder jailed for seven years (15 August 2007)
http://www.channelregister.co.uk/2007/08/15/id_theft_buyer_sentenced/
Google goes spear phishing on MySpace (12 June 2007)
http://www.channelregister.co.uk/2007/06/12/myspace_phishing_/
Phony BBB email dupes more than 1,400 execs (30 May 2007)
http://www.channelregister.co.uk/2007/05/30/bbb_spear_phishing/
Gone phishing with eBay (25 May 2007)
http://www.theregister.co.uk/2007/05/25/ebay_bentley_phish/
© Copyright 2008