Increased use of spam combined with social engineering to spread malware

PandaLabs has detected an increase in the use of spam combined with social engineering to spread malware. Several examples have appeared over the last few days.

The most recent case detected involves emails warning of an alleged malware alert (with subjects such as: Worm alert! or spyware alert!), but whose real aim is to spread the Nurech.Z worm. To make the messages more credible, typically trusted sources such as Customer Support are used as the name of the sender.

Another recent case uses photographs of Britney Spears as bait. The email has subjects including “Britney spears naked pussy & paris Hilton” or “Hot pictures of Britiney Speers”. On opening the email, users will find several erotic photos of the singer. However, when they click on the photo they will actually be downloading the malicious code onto the computer. This worm exploits a vulnerability in Microsoft ANI files in order to spread. This code then downloads other examples of malware onto computers. 

The third example is similar to the previous one, although it emerged a few days later. The only difference is the protagonist. In this case it uses photos of the pornstar Jenna Jameson as a lure to trick users into clicking on the link hidden in the pictures. The result is the same. The malicious code exploits vulnerabilities in ANI files to infect the computer and download more malware.

Another example has been used to spread the Grum.A worm. This malware spreads in emails offering a beta of Internet Explorer 7. As in the previous cases, the message contains a photograph, which in this case supposedly gave access to the beta version of IE 7.