Bird flu spam spreads WMF trojan downloader
Security experts have warned of a new malicious email that uses social engineering playing on the growing fear of an avian flu epidemic to trick users into visiting a malicious website.
Users receive an email with the subject "Attention Bird Flu in England." The body requests users to click on a link to go either of two websites to get more information. The email also claims the government is trying to hide the facts on the flu.
Upon clicking on a link, users are directed to a website that claims the user been blocked from accessing it.
Within the HTML, an IFRAME is loaded that uses the recent WMF exploit to run code without user-intervention. The code is a trojan horse downloader, which connects to another site to download new malicious code. The filename is "expl1.wmf," which downloads and runs "expl1.exe.", Websense Security Labs warned.
In the past, the same sites have been used for phishing, fraud and distributing malicious code, according to Websense. The sites are hosted in the .WS and .CC domains and were up and running at the end of last week.
