« The ACH and NACHA Pestilence | Main | Fake Western Union Transfer Notification »

September 12, 2011

This campaign started up yesterday. Frankly, it's a little confusing, but the goal is the same: to trick recipients into opening an attached file claiming to be one thing, when in truth it's a Trojan loader.

The email begins with a claim that you are registered as some domain you've never heard of. I think they meant registered at rather than as, but that's just me trying to read between the lines. Then comes some statistics about the supposed girl sending the message. Her status is "ONLINE", along with thousands of other girls. A variable number of "fotos" are attached. Here are a few examples (misspellings left intact):

You are currently registered as: latinloveline. com

- Age: 27

- Neme: Madie

- Seeking: A Male. Group 23-49

- Status: ONLINE

- Service: latinloveline. com 9419 Girls Currently Online

- Fotos: 4 fotos in attached file.

- Title: "Cam2cam

I am sweet, single, open minded, sexy and most importantly I am HOT! I have many suitors and still undecided on whom to be my BF and sex My Turn On's... "

===================================

You are currently registered as: fling. com

- Age: 23

- Neme: Latrina

- Seeking: A Male. Group 18-46

- Status: ONLINE

- Service: fling. com 4161 Girls Currently Online

- Fotos: 8 fotos in attached file.

- Title: "I am an event coordinator ready to coordinate some events for us. I have a lot of outdoor fun planned followed by more fun in the bedroom or any room ... "

===================================

You are currently registered as: asianloveline. com

- Age: 29

- Neme: Mandi

- Seeking: A Male. Group 23-48

- Status: ONLINE

- Service: asianloveline. com 7759 Girls Currently Online

- Fotos: 4 fotos in attached file.

- Title: "Hi guys im very hot and sexy....

i see my self very much sexy and attractive...and im fun to be with in bed..i can fullfill your fantasies babe..... "

I laughed when I saw the target demographics because I'm well past the top end. I might have a skin tag that falls within the range.

Alas, I suspect this campaign will be relatively successful in attracting new PCs to a network of remotely-controlled computers. Although the Trojan file has so-so coverage by antivirus products, my guess is that a high percentage of recipients who are fooled into opening the attachment aren't sufficiently protected.

Attachments from unknown senders are killers. Pass the word...to everybody.