Users have been warned that emails containing a link to download an electronic Independence Day-themed greeting card are in fact spam that instead downloads malware.
The Storm trojan has been active since January this year and in its current guise it comes via an email inviting recipients to click on a link to receive an Independence day greeting from a friend. The link leads to a compromised computer hosting the JSecard-A trojan. The malware then attempts to download the Mal/Dorf-C malware.
Among the subject lines used in the spam emails include, "America the Beautiful", "Independence Day Celebration" and "July 4th Fireworks Show".
Should the malware successfully download and install, the victim's computer then becomes part of a botnet. The Storm trojan has appeared in a variety of guises over the last few months, usually piggybacking on current events in a bid to entice users into downloading the malware.
"Today's run of the Storm trojan using the fourth of July as its hook continues this theme of exploiting current events to entice unsuspecting email users into infecting themselves," said Bradley Anstis, director of Product Management at email security company Marshal.
Graham Cluley, senior technology consultant at anti-virus company Sophos said that the fact that the web link contains an IP address instead of a web address should said ring alarm bells for users.
"Rather than being sent to a real ecard website when you click on the link, you are visiting someone else's compromised computer which is hosting malicious code designed to infect your Windows PC," said Cluley. "It is these same computers, based all around the world, which are spewing out spam."
Virus researchers said that these types of viruses are becoming more popular with hackers and it wasn't a surprise that criminals used the US national holiday to fool users into downloading malware.
Patrik Runald, technical manager at F-Secure said that hackers are working hard to avoid detection.
"What's great is that the security community is actively trying to get these sites shut down but the bad guys just keep on changing the IP address in the new mails," he said. "In addition, they keep changing the files that are being downloaded."
