Phishers are using spoofed email addresses from the US Computer Emergency Response Team (US-CERT) to trick recipients into downloading a malicious executable.
The emails is send from the spoofed email address “[email protected]”,with subject “Phishing incident report call number: PH0000003863970”.
The fake warning claims US-CERT has opened the incident number PH0000007135030 and invites recipients to enquire about updates at [email protected] with the reference PH0000006681938.
The attached zip file is titled “US-CERT Operation Center Report {Random value or string}.zip”.The zip attachment contains an executable file with the name “US-CERT Operation CENTER Reports.eml.exe”.
Quick Heal detects this “US-CERT Operation CENTER Reports.eml.exe” as “TrojanDropper.Injector.bsab”.
Trojan, being used to spy information, mostly bank access and transaction data.
Quick Heal advises that users do not open the email or any of the attachments and promptly delete the email from their inboxes.
Leave a reply
