« Phony DHL Invoice Malware Delivery | Main | Phony Classmates Spam »

March 24, 2009

The usual modus operandi of the phisher is to spam an email message claiming to come from an organization (e.g., financial institution) and bearing a link to a web site (usually a hijacked site) where a phony login screen appears. BTDTGTTSAWIO.

I saw a PayPal phishing message today that tried to work around smarter email recipients who know not to click on links. Here's the message:

Subject: You have successful added a new email adress [sic*2]

Dear PayPal member,

You have added [removed]@hotmail.com as a new email address for your PayPal account.

If you did not authorize this change, check with family members and others who may have access to your account first. If you still feel that an unauthorized person has changed your email, submit the form attached to your email in order to keep your original email and restore your PayPal account.

Thank you for using PayPal!
The PayPal Team

Please do not reply to this email.
This mailbox is not monitored and you will not receive a response.

----------------------------------------------------------------------------------------
Copyright © 1999-2009 PayPal. All rights reserved.

PayPal Email ID PP007

The attachment is a file named Email Reset Form.pdf.html. The file name is using one of the oldest tricks in the book, namely to use a double extension in the hope that the user has the default "hide extensions" option turned on in Windows, thus making the file look like a PDF file. While we know that a PDF file is not guaranteed to be safe, I doubt most non-techie users have the same fear, and would treat the file as something to open safely.

Wrong!

The file is a base-64 encoded HTML file. Opening it from an email client would launch the user's default browser and load the page. The page contains nothing but a meta-refresh tag that automatically navigates to a hijacked server in Texas. And that destination has yet another meta-refresh tagged page going to a DNS server in Florida that has been pwned to serve up a thoroughly bogus, but extremely believable PayPal login page.

It appears to me that everything about this campaign except the Subject: line of the message is from a polished, off-the-shelf phishing kit. Maybe the scammer needs the funds to take the next semester of English language class, where they teach adverbs and spelling.