University of Alabama Discovers New Spam Campaign

According to security researchers at the University of Alabama (UAB) at Birmingham, a newly-launched malicious e-mail campaign is using fake messages that seem as if they have been sent by the university's Social Security Administration. The e-mail campaign actually targets recipients' Social Security Numbers and downloads malicious software on their private PCs.

Those credited for discovering the campaign on November 23, 2009 are UAB's director of computer forensics 'Gary Warner' and his group of researchers from the UAB Spam Data Mine, as reported by NBC13 on November 23, 2009.

Warner further states that in the present tough economic conditions, cyber criminals (like spammers) are taking advantage of people's worries about money. They promise breaks from taxes and payout of Social Security to users who agree to submit to their phony websites on Social Security.

The spam mails' sender's address is "auto-notifications@ssa.gov." the e-mail state that because of potential calculation mistakes, the recipient's yearly statement of Social Security transactions might have errors. The user can review his statement by clicking on a given link.

But upon clicking the link, Warner states that the fake web-pages ask for the Social Security Numbers of users after which they direct them to download their bogus SSN statement. Actually, when users enter their Social Security Number, they are led to an imposter page, which offers a link namely 'Generate Report' that on clicking encourages them to perform the malware download.

This malware, a data-stealing virus, seizes the users' personal information like online banking passwords that, according to Warner, enables the cyber criminals to break into the users' bank and other financial accounts.

The UAB Spam Data Mine discovered the e-mail scam while conducting its regular day-to-day searches for the most prevalent e-mail scams. UAB performs these searches every 15-mins because of the large amounts of spam mails that come into the inboxes of Data Mine daily.

Indeed, Warner draws Internet users' attention to the fact that an authorized agency or company wouldn't ever request anyone for updating or examining their records through e-mail, rather it would make such appeals only via its official website.

Related article: University Reports Increase in Spam

» SPAMfighter News - 12/2/2009