Fake Microsoft "critical update" spam propagating trojan

First detected on Friday, the message reads: “This update is critical and provides you with the latest version of Microsoft Outlook/Outlook Express and offers the highest levels of stability and security.” The email instructs users to visit the “Microsoft Update Center,” but when attempting to follow the link, they download a trojan known as “ZBot” or “Zeus,” Ivan Macalintal, threat researcher at Trend Micro, told SCMagazineUS.com.

“ZBot is a notoriously known information stealer,” Macalintal said.

Upon execution, ZBot copies itself onto a user's computer and creates two files -- one is an encrypted file that is downloaded from a remote server and contains commands from the botnet master. The commands contain a list of targeted banking institutions, social networks and other sites for the trojan to monitor, including Facebook, MySpace, Flickr, Bank of America and Wachovia, Macalintal said.

If a user visits one of these sites, the trojan will log a user's keystrokes to obtain login credentials, along with credit card or other sensitive information. It saves the information that is gathered in a second file created on the user's computer, and then sends the file back to the attacker's server, Macalintal said.

Macalintal added that there have been many variants of this trojan in the wild and it was previously infecting users by means of drive-by download. A previous variant masqueraded as an email notice from UPS. A different email attack, spoofed to look like it was coming from Delta Airlines to confirm a ticket purchase, had distributed a trojan with properties of ZBot.

The most recent attack is still being circulated in the wild, Macalintal said. Considering that there have been many legitimate Microsoft updates in the past, this malware has the potential to infect a large number of users, he added.

In October, security researchers warned of a similar attack, in which a fake phishing email seemingly coming from Microsoft contained a different trojan.

See original article on scmagazineus.com