Unusual Customs
The people who brought you the recent malware in UPS spam, then in tax-themed spam, are now pumping out Customs-based messages.
The current run has subject lines including the following:
Customs - We have received a parcel for you
Customs, please read
Parcel requires declaration
Your parcel is at the customs office
The messages start with a greeting, and go on to say:
We have received a parcel for you, sent from France on July 9. Please fill out the customs declaration attached to this message and send it to us by mail or fax. The address and the fax number are at the bottom of the declaration form.
The attachment this time is called Bill_Tax.zip, and the Trojan inside is a variation of what we’ve seen previously, detected proactively as Mal/Spy-A.
Posted on July 24th, 2008 by Richard Cohen, SophosLabs CanadaFiled under: Malware, Spam
