Bogus F-Secure emails hide nasty worm

Antivirus firm F-Secure has issued a warning about a rash of spoof emails purporting to come from its researchers.

The emails, apparently from a 'David Adams' at F-Secure, tell the recipient that they are having problems with their browser, and include a screenshot in a .zip file.

But the file contains a new worm variant called Breplibot.AE which installs a backdoor to allow remote control of the PC. It also attempts to shut down any security software running on the machine.

The email reads: 'I noticed whilst browsing your site that there were problems with some of your links, when I tried again with Internet Explorer the problems were not there so I assume that they were caused by me using the Mozilla browser.

'As more people are turning to alternative browsers now it may be of help for you to know this. I have enclosed a screen capture of the problem so your team can get it fixed if you deem it an issue.'

F-Secure has confirmed that it has no employee by the name 'David Adams' and does not distribute emails with attachments to its customers in this way.

"There is a mass spamming underway right now. Some emails were also spoofed from editor@f-secure.com or from info@f-secure.com," said Mikko Hyppönen, chief research officer at F-Secure on the company's blog. 

"The emails are not sent from our network. They are just spoofed to look like they are coming from an F-Secure address."

See also:

Trojan circulates as fake McAfee patch

Spam email lures users to spoofed antivirus download page  14 Dec 2005

Worm creates fake Google site

Spoofed webpage is identical, but displays alternative ads  19 Sep 2005

Virus hidden in fake FBI email

Opening attachment is a 'dangerous' business, says law enforcement agency  24 Feb 2005

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!