Spoofed Delta Airlines emails contain trojan

Share this article:
Updated Friday, Feb. 27, 2009 at 5:35 p.m. EST

Emails spoofed to look like they are coming from Delta Airlines to confirm a ticket purchase are attempting to infect users with a trojan, according to a Belgium-based security firm.

The fake emails instead contain a ZIP attachment, which, if clicked, installs a data-stealing trojan, Peter Louies, manager at email security vendor MX Lab, told SCMagazineUS.com Friday.

Delta posted an advisory on its website alerting users of these fraudulent emails and warning them not to open the attachment.

"These emails did not originate with Delta, nor do we believe that any personal information that our customers provided to us was used to generate these emails," the advisory says.

The trojan, named W32/Trojan2.FXRO, has the characteristics of Zbot – a banking trojan, Louies said. It will try to steal sensitive and personal information, such as login IDs and passwords. In most cases, trojans such as these also can connect to other hosts and install additional malware without alarming the user, Louies said.

The attack likely originates in Russia, but the messages are likely coming from compromised hosts, Louies said.

A technique called email address spoofing was used to cover the tracks of the real sender, he said. The emails always have two "From" addresses, with the real "From" address sent in the SMTP protocol communication level, not seen by the user.

The spoofed "From" address, support@delta[dot]com, was included inside the email and is visible to the receiver, making the messages appear to be coming from Delta, Louies said.

Louies said that since MX Lab is a small email security firm it is very difficult to specifically define the impact of this malicious email and how widespread it is worldwide.
Share this article:

Sign up to our newsletters

More in News

Cyber Command tests gov't collaboration in wake of attacks

The two-week exercise, "Cyber Guard 14-1," was completed this month.

Text message spammer settles charges filed by FTC

Text message spammer settles charges filed by FTC

Rishab Verma and his company agreed to settle charges filed by the FTC that Verma sent millions of spam text messages that deceitfully promised free merchandise.

Rhode Island hospital to pay $150K for past data breach

More than 12,000 patients' personal and health information was compromised in a breach at The Women & Infants Hospital of Rhode Island.