The email shown below is a current example of “payment rejected” emails that have circulated in large numbers in the past 3 weeks. The links in the email lead to malware similar to that described a previous post .  In the example above the malicious JavaScript files were hidden within the

Facebook has confirmed that a series of pornographic and violent images posted on user walls this week were the result of a self-xss attack. XSS = cross site scripting. Self-XSS means that the malicious script was actually activated by a user and was not part of some hidden webpage code.

A malware-email outbreak in the past 24 hours uses phony Delta airline itineraries to entice users to click on the embedded links.  The social engineering of an attack such as this is very effective – particularly since the email looks very authentic: If you are planning a trip then you

We have previously described the tell-tale signs of a 419 (advance fee fraud email). Refresher: recipients of an email are offered a large amount of money. Actually getting “the money” involves several advance payments (for customs duties, bank charges, bribes etc.) – and of course the only ones who actually

VB2011 was held from October the 3rd till the 7th in Barcelona, Spain. We were privileged to be part of the conference where we presented “A study of malicious attacks on Facebook” (abstract here). Being fully committed to the security industry, we felt compelled to do this research that summarizes

You’ll have to take our word for it – the text below comes from Chinese spam. The text asks recipients to view the attached Excel sheet and forward it on to any relevant staff.  Of course this sort of text is bound to trigger content-based spam filters, so creative spammers

Consider a spam email that promotes an online casino site. URL check and filtering systems that block access to such sites usually run a few checks before adding the URL to the “spam” category. One of these checks is that the URL is registered. Once this is known the date

Scammers have been quick to capitalize on the death of Muammar Gaddafi by sending out emails from Ayesha Gaddafi. Ayesha (also spelled Aisha) is the daughter of Muammar Gaddafi who has reportedly fled to Algeria. The creators of the email seem to have made an error by including the message

In Late September we posted a survey where we asked you to tell us your stolen account stories. We have summarized the results in a special report “the state of hacked accounts” The data reveals that most users get hacked at high rates even when they do not think they

Compromised Facebook accounts are being used to send out scam posts promising free Apple Macbooks. The scam does not make reference to the death of Steve Jobs as others have. The link leads to marketing affiliate sites that ask for a user’s mobile phone number – users are then signed