A new wave of spam that disguises itself as a Microsoft security bulletin contains a link to malicious software that gives attackers complete access to the infected machine, security researchers are reporting.
The e-mail, which began circulating late last Tuesday identifies itself as Microsoft Security Bulletin MS05-039 and offers a link to what it claims is a patch against the Sober Zafi and Mytob worms. In fact, there is no such thing as Microsoft Security Bulletin MS05-039, and real Microsoft security bulletins offer links to a Microsoft download site, rather than to the patches themselves, stated Mikko Hypponen, director of antivirus research at F-Secure Corp.
The phony patch is a variant of the SDBot Trojan software, which is at present not detected by all antivirus software products. The risk of someone downloading this Trojan appears to be very low right now, because the server hosting the Trojan downloads no longer appears to be active, Hypponen explained. “I think this particular case is not going to be a problem anymore, but nevertheless it was a fairly interesting case and I wouldn’t be surprised to see more of this happening,” he added.