Cutwail botnet authors behind wave of malicious IRS spam

Share this article:
Researchers at an email security firm warned Wednesday of a new spam run that seeks to infect machines by tricking users into believing the U.S. Internal Revenue Service (IRS) is trying to contact them over a fraudulent incident.

The bogus emails, being sent at a rate of 90,000 per hour, are trying to seed U.S.-based machines with Cutwail, the world's highest-volume spam-sending botnet, Sam Masiello, vice president of information security at MX Logic, told SCMagazineUS.com on Wednesday.

The subject of the messages falsely informs recipients that they have under-reported their incomes, resulting in fraud, and the body contains a link inviting users to review their tax statement on the IRS website, he said. If they click on the link, victims are directed to a mock website that contains additional links. If they then click on one of those, a trojan is downloaded. Detection rates currently are limited for the variant used in the attacks.

"They're trying to entice the user to react before they can think," Masiello said, adding that the emails are not specifically targeting any businesses, as spear phishing campaigns have done in the past.

Nancy Mathis, an IRS spokeswoman, told SCMagazineUS.com on Wednesday that it was aware of the scam and that recipients should forward the emails to phishing@irs.gov.

"Our message to people is to beware of emails purporting to be from the IRS," she said. "The IRS does not send unsolicited emails. We do not seek personal or financial information through emails."

This is not the first time that the IRS has been picked on by malware writers. In February, it was the source of a phishing campaign involving stimulus-package payments.

"Please remember that the IRS does not know your email address and will not conduct official business with you over email," Masiello said Wednesday in a blog post, which contained screen shots of the spam. "Any email purporting to do so is a scam and should be deleted immediately."



Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Adobe exploit used to spread Dyre credential stealer

Adobe exploit used to spread Dyre credential stealer

Users running vulnerable Adobe software could be in danger of having credentials for Bitcoin websites stolen.

Staples is investigating a potential issue involving credit card data

Staples is investigating a potential issue involving credit ...

The company said it is investigating a potential issue involving credit card data and that customers are not responsible for fraudulent activity on cards if an issue is discovered.

Skills set a priority over legacy prejudices, experts say

Skills set a priority over legacy prejudices, experts ...

Cybersecurity expert Winn Schwartau and Robert Clark, a cyber law attorney at the Army Cyber Institute, discussed issues around hiring in the information security industry.