don't go phishing

Cutwail botnet authors behind wave of malicious IRS spam

 

Researchers at an email security firm warned Wednesday of a new spam run that seeks to infect machines by tricking users into believing the U.S. Internal Revenue Service (IRS) is trying to contact them over a fraudulent incident.

The bogus emails, being sent at a rate of 90,000 per hour, are trying to seed U.S.-based machines with Cutwail, the world's highest-volume spam-sending botnet, Sam Masiello, vice president of information security at MX Logic, told SCMagazineUS.com on Wednesday.

The subject of the messages falsely informs recipients that they have under-reported their incomes, resulting in fraud, and the body contains a link inviting users to review their tax statement on the IRS website, he said. If they click on the link, victims are directed to a mock website that contains additional links. If they then click on one of those, a trojan is downloaded. Detection rates currently are limited for the variant used in the attacks.

"They're trying to entice the user to react before they can think," Masiello said, adding that the emails are not specifically targeting any businesses, as spear phishing campaigns have done in the past.

Nancy Mathis, an IRS spokeswoman, told SCMagazineUS.com on Wednesday that it was aware of the scam and that recipients should forward the emails to phishing@irs.gov.

"Our message to people is to beware of emails purporting to be from the IRS," she said. "The IRS does not send unsolicited emails. We do not seek personal or financial information through emails."

This is not the first time that the IRS has been picked on by malware writers. In February, it was the source of a phishing campaign involving stimulus-package payments.

"Please remember that the IRS does not know your email address and will not conduct official business with you over email," Masiello said Wednesday in a blog post, which contained screen shots of the spam. "Any email purporting to do so is a scam and should be deleted immediately."

Comments

[Addison Ingle]

Unfortunately, I think I know of one poor victim. Nice, timely post. Thanks for the info.