Cutwail botnet authors behind wave of malicious IRS spam

Share this article:
Researchers at an email security firm warned Wednesday of a new spam run that seeks to infect machines by tricking users into believing the U.S. Internal Revenue Service (IRS) is trying to contact them over a fraudulent incident.

The bogus emails, being sent at a rate of 90,000 per hour, are trying to seed U.S.-based machines with Cutwail, the world's highest-volume spam-sending botnet, Sam Masiello, vice president of information security at MX Logic, told on Wednesday.

The subject of the messages falsely informs recipients that they have under-reported their incomes, resulting in fraud, and the body contains a link inviting users to review their tax statement on the IRS website, he said. If they click on the link, victims are directed to a mock website that contains additional links. If they then click on one of those, a trojan is downloaded. Detection rates currently are limited for the variant used in the attacks.

"They're trying to entice the user to react before they can think," Masiello said, adding that the emails are not specifically targeting any businesses, as spear phishing campaigns have done in the past.

Nancy Mathis, an IRS spokeswoman, told on Wednesday that it was aware of the scam and that recipients should forward the emails to

"Our message to people is to beware of emails purporting to be from the IRS," she said. "The IRS does not send unsolicited emails. We do not seek personal or financial information through emails."

This is not the first time that the IRS has been picked on by malware writers. In February, it was the source of a phishing campaign involving stimulus-package payments.

"Please remember that the IRS does not know your email address and will not conduct official business with you over email," Masiello said Wednesday in a blog post, which contained screen shots of the spam. "Any email purporting to do so is a scam and should be deleted immediately."

Share this article:

Sign up to our newsletters

More in News

Report: SQL injection a pervasive threat, behavioral analysis needed

Report: SQL injection a pervasive threat, behavioral analysis ...

Long lag times between detection and resolution and reliance on traditional methods impair an organization's ability to combat SQL injection attacks.

WhatsApp bug allows for interception of shared locations

Researchers identified a vulnerability in WhatsApp that could enable an attacker to intercept shared locations using a man-in-the-middle attack, or a rogue access point.

Google tweaks its terms of service for clarity on Gmail scanning

The company is currently dealing with a lawsuit that challenges its email scanning practices.