Hackers Exploit Tax Season to Spread Malware

Security researchers at Trend Micro have cautioned people that hackers are exploiting tax season by sending mails that seem to have come from the Internal Revenue Service (IRS).

As per the details released by the security company, the mail cautions recipients of under reporting or not reporting of their incomes in line with the tax season (April 2010). The mail tells the users to click on attached link to rectify the supposed mistakes.

But on clicking, the URL leads the users to install a ZBOT or Zeus variant known as TROJ_KRAP.SMDA that steals data from users' systems and then sends the stolen data to a remote user, similar to the previously detected Zeus Trojan variants. Trend Micro states that this variant terminates security related processes as well as disables Windows Firewall.

The attack is a new attempt to hit users with Zeus malware.

Further, the method discovered by Trend Micro is an old one. In the latest tax season, both the US and UK users were attacked by social engineering malware disguised as documents from tax department officials.

Besides Trend Micro, security agencies like the US-CERT and SANS have also complained about the same harmful mail. Similarly, IRS has decided to spread awareness among people about these mails.

Doug Shulman, Commissioner of IRS, stated that taxpayers should be alert about scam mails that sound too good to be true. IRS fights deception by following taxpayers who hide income abroad and by assuring taxpayers get competent, ethical service from trained professionals at home in the US, as per the news by scmagazineus on March 26, 2010.

Meanwhile, the US-CERT urged users and officials to take precautionary steps so as to avoid phishing and other malware scams. These steps include not following uninvited web links given in e-mails; referring to the IRS website related to fake website scams and phishing e-mails for samples of scams and reporting the matter.

Finally, users should keep their security solutions updated so that such harmful mails do not reach user's inbox in any possible way.

Related article: Hackers Redirect Windows Live Search to Malicious Sites

» SPAMfighter News - 4/6/2010