Zeus malware takes aim at tax season

The notorious Zeus malware has been spotted masquerading as US tax documents.

Sans researcher Kevin Liston reported that the organization had been receiving reports of unsolicited emails claiming to come from the United States Internal Revenue Service (IRS.)

The emails claim that the user has "underreported income" on their tax statements and urges the user to downloaded and run a linked file. The linked file is an executable which infects the user with the ZeuS malware.

The technique is not new. In recent tax seasons users in both the US and UK have been targeted by social engineering malware attacks masquerading as documents from tax authorities. The IRS does not send official notifications via email and users are advised to avoid any email messages claiming to be from the agency.

The attack is the latest attempt to infect users with the Zeus malware. Already gaining a level of infamy amongst the security community, Zeus allows an attacker to locally edit HTML files on the user's system turning normally benign web pages into phishing sites and allowing the attacker to harvest credentials without the knowledge of users.

Zeus is not operating without opposition, however. The security community has begun tracking malware activity and has adopted a new strategy of notifying ISPs of the illegal activity and having the servers hosting the botnet shut down at the provider level.