Source : © Trend Micro Nov 2009

We are receiving email messages that supposedly came from Facebook. It asks recipients to update their login credentials for security purposes. It then instructs them to click the URL provided in the email message. When the user clicks the URL, it points them to a spoofed Facebook website where they are required to input their password only as their email address has been automatically filled up.

Once the users hit the ‘Login’ button, it will redirect them to another fraudulent page where a link to download a suspicious update tool file is provided. Trend Micro detects this as TROJ_ZBOT.CDX.

As of this writing, the phishing URL as well as the malicious file has been blocked and detected already via the Trend Micro Smart Protection Network.

This is a great example showing just how cunning cybercriminals can be just to steal precious information. They even claimed to offer recipients security, which is really ironic. Not everyone though may be as hard to fool as, say, security experts. So how can you tell if your personal information is being phished? Here are some useful tips:

§ Check the email’s content. Misspellings and grammatical mistakes are very common in spammed messages.

§ Do not click embedded links. If you need to update your login credentials, go to the site’s homepage and log in from there.

§ Check the URL in the message body. A legitimate Facebook link will not continue beyond .com as in the two bogus email messages.

§ Check the time stamps. Facebook has millions of users worldwide so it really is very unlikely that the site’s administrator will send out email messages to all users within the same day.

§ Check the sender’s email address. A legitimate Facebook email sender will have a facebook.com and not a facebookmail.com address.

Don’t be just another victim. Keep in mind that cybercriminals will do just about anything to fool those who let their guards down.

Sentinel Business IT Ltd  www.easylifeit.com

0800 043 9186

November 2009

Source : Trend Micro – 16th October 2009

http://blog.trendmicro.com/zbot-spam-campaign-continues/

A slightly modified Zbot spam campaign currently making rounds pretend to come from the IT support of various companies. It informs users that a security update in the mailing service caused changes in their mailbox settings. They are instructed to open the ZIP attachment and run the .EXE file, INSTALL.EXE to supposedly apply the changes. Trend Micro detects this as TROJ_FAKEREAN.CF.

When executed, this Trojan accesses http://{BLOCKED}nerkadosa.com/xIw1yPD0q5Gb8t0br4×6k5sk to download another malicious file detected as TROJ_FAKEREAN.BI.

Spammers usually employed random email address in the FROM and TO field headers but in this case, the actual company domain is used as email addresses in both fields. This is done to make the email message more credible, and convincingly coming internally from the company, thus luring unknowing users into executing the malware.

This attack is a follow-up on the phishing email we blogged earlier this week. The said email purports as a notification from the company’s “system administrator” to update the user’s system because of a server upgrade. Accordingly, the subdomains are tailor-made to make it more legitimate.

Users are encouraged not to open suspicious-looking emails even though it supposedly came from a trusted source. It is also advisable that users contact first their IT or tech support in case they received such emails to verify if indeed a security update had occurred. Trend Micro protects users from this attack with its Trend Micro Smart Protection Network that blocks and detects the said malicious file.

Read more: http://blog.trendmicro.com/zbot-spam-campaign-continues/#ixzz0U7j1gwV5

Lindsey Hall. EasylifeIT – 16th Oct 09