Fake Microsoft Attack E-mails Hit Inboxes

Fake e-mails that appear to warn about an Outlook zero-day security threat but instead attempt to install malware are making the rounds, according to the Internet Storm Center.

According to an example in the ISC's post, the e-mails are personalized with at least the first name of the intended victim and appear to come from "Microsoft Corp update@microsoft.com." They read as such:

You are receiving this message because you are using Genuine Microsoft Software and your e-mail address has been subscribed to the Microsoft Windows Update mailing list.

A new 0-day vulnerability has appeared in the wild and was reported for the first time Monday, June 18th. The vulnerability affects machines running MICROSOFT OUTLOOK and allows an attacker to take full control of the vulnerable computer if the exploitation process is succesfull.

As with previous personalized attacks, this message is well-crafted compared to most attack e-mails. On a scan, I noticed two typos in the sample - "Outllok" instead of "Outlook," and "succesful" instead of "successful." But those are minor compared to the egregious grammatical errors that usually give away these spoofed messages.

A link in the e-mail that supposedly points to a Microsoft patch will instead download a Trojan onto your computer. We can expect to see more examples of these relatively well-engineered attacks, so be on your guard. The messages so far have gone back and forth between using attachments and download links to spread their payload.

Comments

Post a comment Post a comment

0 / 1000 max characters