Powered by Movable Type 3.121
Home The Book Training Events Tools Stats
Web log archive.
A Dispatch

« New Twist for FedEx Malware Delivery Email | Main | Fake Reuters.com Malware Lure »

August 02, 2012

Xanga Malware Lure

Xanga, a blogging site, is the latest lure that malware pushers are using to trick unsuspecting recipients into downloading potentially dangerous junk. The message claims to come from Xanga, advising you of a comment someone made on your blog entry:

Fake Xanga email message

The parts I blacked out show the username of the email account to whom the email was addressed. All of the links (including the alleged opt-out link) lead to a web site other than xanga.com, where you'll see the old "Please wait a moment. You will be forwarded..." message while obfuscated JavaScript begins you down the road to malwaredom.

The message body got pretty mangled along the way because in the one I saw, a bunch of CSS code was included in the text-only version, and rendered in my email reader. Can you say "doofus?" A quick look at the message's headers clearly shows the message has no connection whatsoever to xanga.com.

It was easy for me to suspect foul play right in my inbox list because I don't belong to Xanga. But I suspect any Xanga member might be fooled into clicking the link. I just hope those folks have antivirus software installed, or they could be in for a world of hurt.

Posted on August 02, 2012 at 09:49 AM