Federal Reserve spam attack emerges

By

Security officials are warning users after the discovery of a clever new phishing scam.


The US Computer Emergency Response Team (US-CERT) has issued a warning over a new scam pretending to be from the US Federal Reserve.

The spammed messages direct users to a web page which warns of a new phishing scam targeting users.

The message contains a fake Federal Reserve letterhead and warns users that "a large-scaled phishing attack started and has been still lasting." In addition to its shoddy grammar, the messages are identifiable in their attempt to lure victims to an outside URL.

Upon clicking the link, the user is briefly sent to a fake Federal Reserve page which attempts to download a PDF file, supposedly containing further details on the attack. Shortly after accessing the page, the user is forwarded to a pornographic web site.

According to Trend Micro advanced threats researcher Joey Costoya, the PDF file is loaded with malicious JavaScript. Upon launching, the code attempts to download and install a number of malware packages to the user's systems, including a botnet controller file.

Costoya noted that the botnet uses a Secure Socket Layer (SSL) connection to send and receive encrypted information between the botnet server and infected machines, a particularly interesting characteristic.

"This is certainly an improvement over the Web-based bots of old, where traffic [is] seen in plaintext," he explained.

"Makes one wonder what else the bad guys have in store for us."

In addition to keeping updated system and antivirus software, US-Cert is recommending that users exercise caution when viewing unsolicited messages and avoid clicking on any links which may seem suspicious.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Log In

  |  Forgot your password?