We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Scammers fake Microsoft security alerts

Malicious 'bulletins' contain malware

Scammers are sending out fake Microsoft security bulletins that install malicious software on victim's computers. Microsoft's genuine monthly patch release is expected tomorrow.

The fake Microsoft email messages claim to describe a "Cumulative Security Update for Internet Explorer" that fixes a critical security flaw in the browser. It comes with a link entitled "Download this update."

When users click on this link in the malicious fake Microsoft email, they are taken to a server that attempts to install malicious software known as Trojan-Downloader.Win32.Agent.avk.

This Trojan software then attempts to reach out to other computers on the internet to install more programs on the victim's computer.

The SANS Internet Storm Center received its first and only report of the scam last Thursday night but a second sample has also been posted to the Chinese Internet Security Response Team blog.

SANS volunteer Lenny Zeltser believes that the criminals behind this scam may be gearing up for more activity. The Trojan looks for three different servers and two of them have domains that haven't yet been registered. He suspects the authors of the scam may be planning to register those domains before embarking on a more widespread campaign.

The two email samples contained obvious errors that would be caught by technically savvy users. For example, although the patch Zeltser examined claimed to have been issued in June 2007, it was entitled MS06-4 instead of the more-plausible MS07-004.

Still, these scams need to fool only a small percentage of victims in order to be successful, said Zeltser, information security practice leader at Gemini Systems LLC in New York.

"You wonder, does it really matter that there are these strange discrepancies in the way the fake security alert is written," he said. "People who would notice probably would be the kind of people who wouldn't click on the link."

Another tip-off: Microsoft does send out notification email when it publishes security bulletins, but the links in these alerts take users to the bulletins themselves, not to executable downloads.

Get the latest PC security news, reviews and downloads here


IDG UK Sites

Best Black Friday 2014 tech deals UK: Get bargains on phones, tablets, laptops and more this Black...

IDG UK Sites

Tomorrow's World today (or next year)

IDG UK Sites

25 iOS apps turn (Red) for World AIDS Day campaign

IDG UK Sites

Advanced tips for Mac OS X Yosemite: use Yosemite like an expert - 5 new tips added