Massive attack launched against Microsoft’s Outlook

Websense warns of highly targeted attack.

Internet monitoring firm Websense has warned that a massive attack has been detected against Microsoft’s Outlook Web Access service.

The company said that it was receiving around 30,000 emails a day which urge users to visit a web site and download a security update file, which in fact contains malware.

“We are informing you that because of the security upgrade of the mailing service your mailbox settings were changed. In order to apply the new set of settings click on the following link,” the emails read.

What makes the attack more unusual is the high level of personalisation that the attacks use. The page the recipient is sent to is very convincing, because it uses the victim’s email address and domain name to persuade people to download the update, Websense said.

“We’ve seen customisation like this before but it’s not very common,” the company said.

“As the angle is Outlook Web Access, a corporate/enterprise system, it’s very likely that the targets are primarily corporations.”

“Websense Security Labs has seen a rise in banking Trojans that are targeting corporations because not only do those accounts have more money in them, they can typically also do international wire-transfers directly from the online banking system.”

The malware installed makes the PC part of the Zbot botnet and allows full remote control by the botnet controller.