New Twist on IRS Spam

There is a new twist on the IRS emails that have been delivering zbot and other threats over the last month. In some new emails, reports Gary Warner, the link contained in the message is to Geocities.

An example from the CyberCrime & Doing Time blog:
hxxp://geocities.com/FreddyCampbell36/ohuloc.htm

While the users will ultimately end up at the commonly used http://www.irs.gov.blah.blah.co.uk/fraud_application/directory/statement.php?etc... type url, the attackers are now using Geocities as an intermediary.

This makes it increasingly difficult for spam and av scanners to detect the malicious URL and block the email from reaching unsuspecting users. Warner reported that a VirusTotal scan showed very low detection rate - another repackaged zbot to bypass detection.

For more information, including a list of dangerous URLs visit the CyberCrime & Doing Time blog!

http://garwarner.blogspot.com/2009/10/irs-zeus-via-geocities.html