Users receive an email with the subject "Attention Bird Flu in England." The body requests users to click on a link to go either of two websites to get more information. The email also claims the government is trying to hide the facts on the flu.
Upon clicking on a link, users are directed to a website that claims the user been blocked from accessing it.
Within the HTML, an IFRAME is loaded that uses the recent WMF exploit to run code without user-intervention. The code is a trojan horse downloader, which connects to another site to download new malicious code. The filename is "expl1.wmf," which downloads and runs "expl1.exe.", Websense Security Labs warned.
In the past, the same sites have been used for phishing, fraud and distributing malicious code, according to Websense. The sites are hosted in the .WS and .CC domains and were up and running at the end of last week.
Email body:
"Attention !!! Bird flu in England !!!
UK researchers reported to government that the H5N1 influenza virus was founded in some birds in the UK. Also, 35 yo man infected with the H5N1 bird flu virus hospitalized in UK hospital ! government trying to hide the true from people despite real facts. All facts you can read here on our website..............."
