The emails contain the header 'Microsoft Security Bulletin MS07-0065' and come with Microsoft logos and a layout very similar to the Microsoft web page.
Recipients are told that a zero-day flaw in Outlook has already been exploited to infect over 100,000 machines, and the email contains a link to the 'patch' for the problem.
"Security bulletins from Microsoft describing vulnerabilities in its software are a common occurrence, so it comes as no surprise to see hackers adopting this kind of disguise in their attempt to infect Windows PCs," said Graham Cluley, senior technology consultant at Sophos.
"The irony is that, as awareness of computer security issues and the need for patching against vulnerabilities have risen, social engineering tricks which pose as critical software fixes are likely to succeed in conning the public."
The link in fact downloads the Behav-112 Trojan, which allows the computer to be operated remotely to send spam or take part in distributed denial-of-service attacks.
The emails have been widely spammed out over the past few days.
.png&h=140&w=231&c=1&s=0)
_(26).jpg&w=100&c=1&s=0)
iTnews Executive Retreat - Security Leaders Edition
_(1).jpg&h=140&w=231&c=1&s=0)
