Intuit payroll free trial email launches malware attack

Graham Cluley
Graham Cluley
@[email protected]

Intuit and malwareHave you received an unsolicited email from – what appears to be – Intuit Supplies Group? Be on your guard..

Malware is being spammed out to internet email users, posing as a message from the payroll software company Intuit.

The emails have the subject line “Your Intuit Online Payroll Free Trial”, but attached to the messages is a ZIP file containing a malicious Trojan horse.

Malicious email claiming to come from Intuit. Click for larger version

Sign up to our free newsletter.
Security news, advice, and tips.

The email looks convincing enough, and you can understand how some individuals and small businesses might feel tempted to learn more about the offer which they believe has been sent to them.

However, the attached ZIP file (which is 196,096 bytes in size) contains a malicious file called

Intuit Online Payroll Free Trial Detailed information.exe

which is designed to compromise the recipient’s computer.

Of course, the emails are not really from Intuit – they are innocent casualties of the attack (their brand is being tarnished). Similarly, internet users who open the file attached to the malicious spam are at risk of falling victim to a malware infection.

Sophos is intercepting the messages as spam, and is adding detection of the Trojan horse file to its security products as Troj/Agent-TZG.

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.