ACH Email Fraud Morphs Into FDIC Notification Scam

It was only a couple of days ago (8/26/2011) that I published a blog article warning people about the threats contained in fraudulent emails claiming that an ACH transfer had been canceled and that the recipient needed to read the report in the attached file.

Beginning at 3 AM, EST, I received four consecutive email scams in 15 minutes, with the subject: "FDIC notification," with the forged sender (the actual "sender" is an infected PC in a spam botnet): "no.reply@fdic.gov," and the following body text:

Dear customer,
Your account ACH and WIRE transaction have been temporarily suspended for
security reasons due to the expiration of your security version. To download and install the newest installations read the document(pdf) attached below.
As soon as it is setup, you transaction abilities will be fully restored.

Best Regards, Online Security departament, Federal Deposit Insurance Corporation.

The attached file is currently named "FDIC_document.zip" - although the filename may change soon.

Like the UPS and ACH scams that preceded it, this scam contains a variant of the Zeus or Zbot Trojan Horse. Its purpose is to install hidden malware that watches for you to visit targeted financial institutions, or your website's control panel, or PayPal, etc. Once you do it intercepts your login credentials and forwards them to the criminals running these scams. Your bank accounts, PayPal accounts and God knows what else may be emptied before you know what hit you!

If you use MailWasher Pro to screen your incoming email for spam and threats in attachments, my custom ZIP Attachment filter will alert you to these and similar threats. Never open the attachments in these scams! Delete the email on sight! Opening these messages will launch the installer for the Zbot. Your PC will not only have the Zeus keylogger installed, but will be made a part of the Botnet from which you received your recruitment message.

Trend Micro Internet Security products,

for home and office users, use in-the-cloud malware definitions that are updated every day, all day, as soon as new or altered strains of viruses and other malware are detected in the wild and analyzed. By offloading the bulk of these ever changing virus definitions to cloud servers, the load on your computers is greatly reduced. All users of Trend security programs are instantly protected from hostile web pages laden with malware exploits and hostile email, by the Trend Micro Smart Protection Network.