Federal Reserve spam attack emerges

The US Computer Emergency Response Team (US-CERT) has issued a warning over a new scam pretending to be from the US Federal Reserve.

The spammed messages direct users to a web page which warns of a new phishing scam targeting users.

The message contains a fake Federal Reserve letterhead and warns users that "a large-scaled phishing attack started and has been still lasting." In addition to its shoddy grammar, the messages are identifiable in their attempt to lure victims to an outside URL.

Upon clicking the link, the user is briefly sent to a fake Federal Reserve page which attempts to download a PDF file, supposedly containing further details on the attack. Shortly after accessing the page, the user is forwarded to a pornographic web site.

According to Trend Micro advanced threats researcher Joey Costoya, the PDF file is loaded with malicious JavaScript. Upon launching, the code attempts to download and install a number of malware packages to the user's systems, including a botnet controller file.

Costoya noted that the botnet uses a Secure Socket Layer (SSL) connection to send and receive encrypted information between the botnet server and infected machines, a particularly interesting characteristic.

"This is certainly an improvement over the Web-based bots of old, where traffic [is] seen in plaintext," he explained.

"Makes one wonder what else the bad guys have in store for us."

In addition to keeping updated system and antivirus software, US-Cert is recommending that users exercise caution when viewing unsolicited messages and avoid clicking on any links which may seem suspicious.

Copyright ©v3.co.uk

attackbotnetfederalmessagesphishingscamsecurity