Sophos Name Used to Strengthen Phishing Attempt

A phishing email, recently brought out, uses the name of Sophos to make it appear authentic, made for deceiving the users and made them visit to a fake site, thus leaking out their valuable details.

The email appears to have come from financial services giant Merrill Lynch and it talks about a warning from Sophos about a Trojan attack which refers to malware hidden in Shockware cartoons which was repaired by Sophos around 2 months ago. The phishing email says in part:

It thanks the customers for opting the Merrill Lynch Business Centre. A warning from Sophos Labs has informed that a malware author has infected several PCs by concealing a new Trojan horse type in a cartoon video that has been distributed worldwide through e-mail. The malware is called Trio/Agent FWO-Trojan and it is hidden in "Yes & No" Shockware video, a cartoon made by Bruno Bozzetto, the famous Italian animator.

Then it asks to use the next link to entering the Merrill Lynch Business Centre through protected online server. Automatically, the system would catch the infection and in the next 60 seconds, the users would get the report to their web browser. But, for logging in, they demand a valid password and ID.

Technical consultant at Virus Bulletin, John Hawes, said that malware appearing as a warning for malware is the most commonly used social engineering technique. To rely on fear for surpassing people's caution responses is common to other lures like greed and sex. The inculcation of Sophos' name may proves to be an add-on for the customers of Merrill Lynch, but seeing the dialect used in the mail they should have understand that it is a fake mail, as per the news in Virus Bulletin on August 21, 2007.

As per the Websense Security Labs, this phishing site has been hosted in Turkey and was present at the time of this alert. Websense also claimed that the incidents of hacking the customers of bank have increased to 81% since 2006.

Recently, a similar case happened. The customers of Axis Bank become the victims of a 'phishing mail'. Also, the official site of Indian Syndicate Bank was infected with a harmful script which tries to install a Trojan Downloader.

Related article: Spike in Attacks Causes Early Release of Windows Patch

» SPAMfighter News - 9/5/2007