Hackers target Windows Update in phishing attack
With users and administrators around the world scrambling to patch a zero-day flaw in Internet Explorer, cyber criminals have launched a new scam targeting Windows Update.
Security vendor Sophos said that the scammers have constructed spam messages which claim to originate from the privacy@microsoft.com email address. The messages, which are designed to resemble official alerts from Microsoft, advise users that their systems might be at risk and advises visiting a supposed "update" page.
Upon clicking the link, however, users are directed to a phishing site which attempts to harvest email addresses for webmail services including Gmail and AOL mail. "At first glance, if you don't look too carefully, the emails entitled "Microsoft Windows Update" may appear harmless enough," wrote Sophos senior technology consultant Graham Cluley.
