Beware a New Wave of Fake Hallmark Greeting Cards

Security specialists note that Internet users are still constantly being fooled by spam e-mails containing malware. The problem is that they either believe the message to be real and providing useful information, or they are simply led by their curiosity.

The latest attack of such threats is related to fake Hallmark greeting cards. A potential victim receives an e-mail with a message that an e-greeting card from Hallmark has been received. Users may be fooled by the graphics of the message that are identical to those used by Hallmark site. The thing that makes these fake messages different from original Hallmark messages is an attachment. Hallmark never sends e-greeting cards with attachments.

The attack begins immediately when the attachment (zip. file), which actually contains a Backdoor.Trojan, is loaded. An executable postcard.exe and a run key to Windows registry will now be downloaded to the victim‘s computer. Run key will run postcard.exe executable during the restart session. Now, this malicious program will be able to add user to remotely-controlled IRC botnet. As a result, new e-mail attacks will be send to others in the user‘s contact list.

Users should also be aware that another slightly modified variant of this attack does not provide any attachments. Here users are prompted to click on a link in order to view the received greeting card. By clicking the provided link, users will be directed to malicious site and their system will be infected.

Such greeting card attacks are not a new issue. They have been successfully working for a long period of time and are extremely popular. Symantec senior business intelligence analyst Amanta Grady notes that "Last year, some of the popular greeting sites were spoofed; Hallmark has been targeted more recently."

Panda Security sub-Saharan head of operations Alex Matthews warns users to be vigilant and look suspiciously at any unsolicited e-mails. He also declares that "If you're not sure of a message's validity, Google it or check with a security vendor to find out whether it is ‘kosher' or not". It is also recommended to read all such messages very carefully and try to find out if any spelling messages exist. What's even more important - users should never open attachments found in suspicious and unclear e-mails.

Resources:

http://www.itweb.co.za

http://www.vnunet.com

Further Reading:

http://www.kentucky.com

http://newsroom.hallmark.com

http://www.symantec.com