Remember the UPS spam runs that were popular last month (see previous blog posts here and here)? Spammers have chosen a different courier this time, but the message was basically the same:
Posing as FedEx notifications, these email messages have the same format as their earlier UPS counterparts: tracking number (perhaps to make the message appear authentic), message body informing recipients that there was a problem with the delivery of a package, and a message urging the recipient to print the attached “invoice” to claim the “package”.
Even the attachment is of the same file type as those seen in the previous spam runs. The .ZIP file is an info stealer detected by Trend Micro as TSPY_ZBOT.MCS. ZBOT spyware are infamous keyloggers that are known to steal confidential information, such as those related to online banking credentials.
Our users are already protected by the Trend Micro Smart Protection Network. While our experts are still doing their analysis on this case, everyone should remember that nothing is free these days – even if malicious emails posing as the world’s largest couriers tell you otherwise.
