Malicious swine flu PDF file spreads password stealer

Symantec's Kevin Haley claimed that the attachment is named ‘Swine influenza frequently asked questions.pdf' and is a real PDF file, and when opened will show a typical 'questions and answers' layout, however by opening it the recipient is infected. Once the download has been completed a clean PDF is opened as a decoy,

Haley said: “Symantec detects the malicious PDF file as Bloodhound.Exploit.6 and the dropped malicious file contained in the PDF as InfoStealer. There is an Adobe patch for this known vulnerability, Adobe Acrobat and Reader PDF File Handling JBIG2 Image Remote Code Execution Vulnerability (BID 33751).

“If you haven't already, it's time to start following best practices and download the Adobe patch for your version of Acrobat and Adobe Reader. Protect yourselves and your computer from the human swine that prey on our desire for information to keep us healthy. Be very careful when such email includes attachments, links to websites, or videos that it says you should view.”

Meanwhile, F-Secure has revealed that a total of 1,344 domains have now been registered using the words ‘swine flu', although at the last check none of the domains are hosting any malicious files.

See original article on scmagazineuk.com