Security firm Sophos is warning Windows users to beware of a fake security update scam that installs a worm in target machines.
The attack arrives in the form of a spam email that appears to come from Microsoft, warning users to update their operating system.
Anyone opening the email is advised to follow instructions, which involve installing the attached KB453396-ENU.zip file.
Microsoft never sends out such emails, instead using its own update system, but Sophos believes the scam could fool some users because it looks official.
“In the current example, they've spammed out an email containing a worm, which even quotes the real name of a senior member of Microsoft's security team - Steve Lipner - to try to fool you into believing it is genuine,” the company said on its Naked Security blog.
The emails have a subject line of "Update your Windows".
