The gang of malware distributors who are currently flooding the Internet with bogus Facebook “Update Tool,” CDC “H1N1 Flu Vaccination Profile,” and IRS “Tax Statement” emails and Web pages are at it again — this time, targeting Visa with a fake email alert that leads to a page hosting not only a Trojan-Backdoor-Zbot installer, but that performs a drive-by download as well. This is the second time in less than a month that malware distributors have targeted Visa; Just before Thanksgiving, we saw a similar scam involving links to bunk Verified By Visa Web pages.
I’d say it’s ironic that malware distributors are using fraudulent transaction warnings as a method to infect users with a keylogger capable of stealing their credit card information when the victim enters it into a shopping Web site, but Visa doesn’t issue these kinds of warnings—the Visa-card-issuing bank warns customers of suspected fraud themselves, and they never do anything with that level of urgency via email.
Once you click through to the Web page, you end up on a page dressed up in its holiday best to look like an official Visa Web site. The top of the page even has your credit card number printed on it! Well, not the whole credit card number. It just prints the number “4XXX XXXX XXXX XXXX” (then goes on to say “to protect your private information, part of the card number is hidden with X’s“). How considerate.
Of course, all bank-issued Visa card numbers in the US are sixteen digits long and begin with a “4” so it’s actually a pretty good guess that the Visa in your wallet right now looks just like that.
The bogus Web page even sports a URL that begins with “reports.visa.com,” followed by a random six- to eight-character domain name, but there the similarities end. The servers hosting the fraudulent pages are based in foreign countries where you wouldn’t expect a major company like Visa to operate its Web presence from, such as Morocco, on networks known to harbor both Koobface and Zbot Trojans. The text on the page claims to have a downloadable transaction report for your card. If you haven’t already guessed, the “statement” is just an installer for the Trojan.
The page goes on to provide worried card owners with helpful advice — helpful like a fox. You have to admire the sheer gall it must take for the malware distributor to write stuff like:
You can tell us your lost or stolen card details, and we’ll arrange for your card to be cancelled.
If by cancelled they mean used to purchase a great deal of expensive merchandise which they will subsequently arrange to ship to the Ukraine, that’s actually pretty accurate. Once the victim’s computer’s infected, if he or she uses a credit card in an online transaction on the infected computer, the victim will end up cancelling the card, eventually.
As in earlier iterations of this scam, Zbot isn’t just interested in transaction details or Website logins. Zbot also steals the login credentials for virtually every Windows FTP client application — the tools that Web designers and other website administrators use to upload files to Web sites. FTP logins are far more valuable, because it gives the malware distributors another means to spread their code onto the Web.
If you’ve been wondering why so many otherwise legitimate Web sites seem to be getting hacked, and having malicious code uploaded to Web sites belonging to small businesses, private individuals, and others, this is why: Zbot is taking those passwords, and handing them off to people who trade not only in malicious code, but in abusing the good reputations of legitimate Website owners or the people who help manage them. Don’t be a victim: Don’t follow the link in the message. Don’t download the “statement” on the page. If you see a page that looks like the screen above, immediately kill your browser and scan your computer for Zbot. The drive-by download component of this scam means you could be infected merely by visiting the page using a vulnerable browser.
Most importantly, if you suspect a credit card fraud report email may be real, pick up the telephone and call the number on the back of your card.
It would be helpful to know if Macs using Safari or Firefox are susceptible to this pasticular scam.
thank you soooo much for all this info..i dont usually open emails i suspect…this was extremely helpful in alerting me on emails i do know of…wud like clearer identification on blocked items though..i always block when you say block,but i dont know what im blocking and from whence it came…again thank you…you are extremely helpful…
You’re welcome.