Cyber criminals were prowling Cyber Monday

Security experts yesterday warned consumers of a rapidly mutating spam campaign using bogus messages from United Parcel Service (UPS) claiming that a package could not be delivered.

The spam run, which actually began earlier this month, is just one way that security researchers believe criminals will exploit the holiday season online buying spree.

According to Cloudmark engineering director Angela Knox, the UPS-based scam uses phony email to dupe recipients into either opening an attachment or clicking on a link to infect machines with malware.

“We’ve seen a number of variants in this campaign, some with attachments, some with no attachments and bad links, all of them personalized to the recipient, and sent from an ever-changing list of fake UPS employees or the generic ‘UPS Customer Services,'” said Knox in a blog post today.

The attached files are actually .zip archives that contain malware, said Knox, while the links lead to compromised or hacker-controlled websites that host attack code.

“With Cyber Monday kicking off the online holiday shopping frenzy, online shoppers should remember to be vigilant about any email message that they receive,” said Knox.

Other security experts echoed that as they cataloged a host of ways criminals could subvert online shopping.

Wolfgang Kandek, chief technology officer of Qualys, warned of hackers exploiting the popularity of discount services such as Groupon and Living Social to feed malicious links via all kinds of avenues, including Twitter, Facebook, email and instant messaging.

Meanwhile, Dell SecureWorks today reported an uptick in malicious messages posing as problems with recipients’ airline tickets, canceled direct deposits and — as Cloudmark noted — shipping invoices.

The malware planted on fooled users’ PCs includes the notorious Zeus Trojan horse, which has been implicated in numerous thefts from U.S. consumers and small businesses, said SecureWorks today.

Experts urged users — both at home and at work, where many shop using their office’s faster Internet connection — to be wary of fake sites and too-good-to-be-true discounts pitched via email and social media.

SecureWorks also encouraged users to ensure that their browsers and browser plug-ins, especially document viewers such as Adobe Reader, music and video player utilities like Flash, are up to date with the most recent security patches.

Bogus messages posing as UPS notices of undelivered packages are just one way criminals will exploit online shopping, experts warn.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Related Tech News

Featured Tech Jobs


CDN in your inbox

CDN delivers a critical analysis of the competitive landscape detailing both the challenges and opportunities facing solution providers. CDN's email newsletter details the most important news and commentary from the channel.