New IRS Spam Emails Campaign Discovered

Security researchers at AppRiver inform that the ongoing spam campaign is generating emails which are concealed as notifications from the Internal Revenue Service (IRS), the US tax agency.

These recent spam emails have the "From" column forged to appear as if they were sent by the US tax agency.

AppRiver informs that in this spam email, the text reveals the person (employer) that he is late in updating the W-2. The W-2 form, which is also known as Wage and Tax statement, is a form that the employers need to submit for each of their employees to report paid wages and the equivalent pending taxes to the Social Security Administration.

The so called "form" attached with the email is a word document named W2form.doc. Within this document, there is a .pdf file, which when opened, will run an .exe. The .exe would further infect the user's computer with a specific malware contained in Trojan.Dropper.

According to the AppRiver, there is also a clear mistake in this email as it contains a due date of 01/07/2010, which is probably an error on the sender's or spammer's part.

The security firm also comments that the recent spam email is a fine example of an emerging trend seen recently, where spammers would have the user think a message is one thing when in fact it is something entirely different. This procedure has been seen most lately in malware pretending as run of the mill Canadian pharmacy spam.

Commenting on the issue, the IRS official said that people should keep in mind that the IRS never sent emails about the taxes. The IRS knew that email was not a safe way to communicate, so it had never talked about a refund, an audit or anything like that through an email, as reported by volunteertv on July 20, 2010. Thus, if anyone got an email like this one, simply delete it, the official added.

Besides, the users are recommended to install an efficient and updated antivirus program on the computer that can help fix the infection caused by the executable file, in case if it is run by the recipient.

Related article: New Zealand Releases Code To Reduce Spam

» SPAMfighter News - 8/2/2010