« A Portuguese Deposit | Main | An ADP Malware Lure »

January 11, 2013

Wow! Today's alleged Intuit Payroll Services alerts are doozies. So far, not one of the messages has had the From: field tied to Intuit. There is Friendster Games and tons of LinkedIn-related addresses. It just gets worse from there:

Subject: Payroll Account Holded by Intuit

[Real Intuit logo sourced from intuit.com]

Direct Deposit Service Informer

Communicatory Only



We cancelled your payroll on Fri, 11 Jan 2013 11:43:57 +0300.

• Finances would be gone away from below account # ending in 0083 on Fri, 11 Jan 2013 11:43:57 +0300


• amount to be seceded: 5133 USD


• Paychecks would be procrastinated to your personnel accounts on: Fri, 11 Jan 2013 11:43:57 +0300


• Log In to Review Operation

Funds are typically left before working banking hours so please make sure you have enough Finances accessible by 12 a.m. on the date Cash are to be seceded.



Intuit must reject your payroll by 4 p.m. Central time, two banking days before your paycheck date or your state would not be paid on time.

QuickBooks does not process payrolls on weekends or federal banking holidays. A list of federal banking holidays can be viewed at the Federal Reserve website.



Thank you for your business.



Regards,

Intuit Payroll Services

As usual, links go to hijacked web site pages that redirect to a different site where malware loading begins. I've seen plenty of machine-translated attempts in malware spam before, but this guy manages to make up words. Holded?

Wow!