Spammer’s blunder leads to widespread split personality malware attack

Graham Cluley
Graham Cluley
@
@[email protected]
@gcluley

UPS FDICWe’re seeing a widespread malware attack in our spam traps this morning – and what’s making it unusual is that it appears not to be able to decide what it is.

When you first see the subject line, you imagine it’s going to be another “undelivered parcel” attack:

United Parcel Service notification #49674

(the tracking number changes in each email)

Sign up to our free newsletter.
Security news, advice, and tips.

And the fact that it uses an @ups.com email address doesn’t do anything to make you think it won’t be another addition to the long line of malware attacks that are spammed out pretending to come from the likes of UPS, FedEx or DHL.

Things get a little weird, however, when you look at the email’s content.

FDIC / UPS malicious email

The message, embedded as an image inside the email, claims to come from the Federal Deposit Insurance Corporation (FDIC).

It claims that there are “important changes in current regulations of endowment insurance procedure” that you should look through, and is signed – with “best regards” from the “Federal Deposit Insurance Corporation Investors Relations Department”.

What a strange email!

On one hand it claims to be from UPS about a delivery, and with a split personality it then claims to be a message from FDIC! The attached file appears to keep up the pretence of being FDIC-related – it’s called FDIC_Document.zip.

Beware opening the ZIP file, however. It contains a malicious file called FDIC_Document.exe. Sophos has added detection of the malware as Troj/Bredo-FA.

UPS FDIC malicious emails

This malicious spam campaign is widespread right now, hitting inboxes around the world. Hopefully the cybercriminal’s botched job will stop some people opening the attachment as its subject line and ‘from’ address is clearly so out of kilter with its email body.

But no doubt there are some folks who will be so puzzled by this email’s split personality that they’ll investigate the attached file, and end up with an infected Windows computer.

15 February 2010 Update: It looks like the bad guys have now realised their mistake, as we’re seeing malicious messages using a “correct” FDIC-related subject line and the embedded image claiming to come from FDIC:

Subject: Important information for depositors of Federal Deposit Insurance Corporation #76367

(the number is still randomly chosen)

Take care folks!


Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.