Cutwail botnet authors behind wave of malicious IRS spam

Share this article:
Researchers at an email security firm warned Wednesday of a new spam run that seeks to infect machines by tricking users into believing the U.S. Internal Revenue Service (IRS) is trying to contact them over a fraudulent incident.

The bogus emails, being sent at a rate of 90,000 per hour, are trying to seed U.S.-based machines with Cutwail, the world's highest-volume spam-sending botnet, Sam Masiello, vice president of information security at MX Logic, told on Wednesday.

The subject of the messages falsely informs recipients that they have under-reported their incomes, resulting in fraud, and the body contains a link inviting users to review their tax statement on the IRS website, he said. If they click on the link, victims are directed to a mock website that contains additional links. If they then click on one of those, a trojan is downloaded. Detection rates currently are limited for the variant used in the attacks.

"They're trying to entice the user to react before they can think," Masiello said, adding that the emails are not specifically targeting any businesses, as spear phishing campaigns have done in the past.

Nancy Mathis, an IRS spokeswoman, told on Wednesday that it was aware of the scam and that recipients should forward the emails to

"Our message to people is to beware of emails purporting to be from the IRS," she said. "The IRS does not send unsolicited emails. We do not seek personal or financial information through emails."

This is not the first time that the IRS has been picked on by malware writers. In February, it was the source of a phishing campaign involving stimulus-package payments.

"Please remember that the IRS does not know your email address and will not conduct official business with you over email," Masiello said Wednesday in a blog post, which contained screen shots of the spam. "Any email purporting to do so is a scam and should be deleted immediately."

Share this article:

Sign up to our newsletters

More in News

Incapsula mitigates multi-vector DDoS attack lasting longer than a month

Incapsula mitigates multi-vector DDoS attack lasting longer than ...

Incapsula's scrubbing servers were able to filter out more than 50 petabits of malicious DDoS traffic aimed at a video game company for longer than a month.

UPS announces breach impacting 51 U.S. locations

The shipping and printing provider said malware has been present on some stores' computer systems since mid-January.

'Machete' espionage campaign targets orgs in Venezuela, Ecuador

The campaign targets Spanish speaking victims, which also appears to be the native language of attackers.