« Malware Lures Today: Xanga and Kindle | Main | New Meaning to "Speed Trap" »

July 05, 2012

For the past few months, malware distributors have been sending messages that resurrected an old chestnut: Trying to trick recipients into opening an attachment supposedly of some compromising photo featuring the recipient. The attachment, of course, isn't any kind of photo, but rather a packaged malware installer. The accusation against the recipient is not too serious — on the order of "I can't believe you were caught in this photo, dude!"—and the tone is almost friendly conspiratorial.

Well, the tone has seemed to shift in the last couple of weeks to be much more hostile. The messages aren't friendly so much as threatening. Here are a few samples:

Subject: You can't say I haven't warned you now enjoy the consequences.

Sorry to disturb you [email address account ID]

Why did you have to put these photos online? All the hell is gonna break loose now don't you understant? Take them down immediately! Don't tell me you don't know what photos I'm talking about! Check attachment!

Subject: Let's put this behind us once and for all I know you broke into my email.

Hello there [email address account ID]
This is quite crazy but someone sent me a nude picture of your girlfriend. Is seems to be her in attachent right? We'll have to track down the bastard who did it I can help you!

Subject: You pig!

You should be stoping ignoring me or i will send this photos to your spouse!!!

It may be difficult to resist getting at the bottom of a false accusation, but we must teach the world's email users that these messages are coming from automated systems that don't know squat about the recipients, other than their email addresses. All attachments and links in such emails should be treated as both molten and radioactive. Direct contact can lead to injury or death (of one's privacy).