ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev
Home / News & Blogs / Zero Day

Spamvertised 'Scan from a HP OfficeJet' emails lead to exploits and malware

By | February 24, 2012, 2:00am PST

Summary: Security researchers from Sophos have intercepted a currently spamvertised malware campaign, enticing end and corporate users into downloading and viewing a malicious HTML file.

Security researchers from Sophos have intercepted a currently spamvertised malware campaign, enticing end and corporate users into downloading and viewing a malicious HTML file.

Sample subjects include:

  • Re: Fwd: Scan from a Hewlett-Packard Officejet 69087080
  • Fwd: Re: Scan from a HP Officejet #43384897
  • Fwd: Re: Scan from a Hewlett-Packard Officejet #1584730
  • Re: Scan from a Hewlett-Packard Officejet 1206754
  • Re: Fwd: Fwd: Scan from a Hewlett-Packard Officejet #886303 1.2
  • Re: Fwd: Fwd: Scan from a HP Officejet #75709542
  • Fwd: Re: Fwd: Scan from a Hewlett-Packard Officejet #128469
  • Fwd: Re: Re: Scan from a Hewlett-Packard Officejet #662447
  • Re: Scan from a HP Officejet #49477094
  • Fwd: Fwd: Scan from a Hewlett-Packard Officejet #885932
  • Fwd: Fwd: Scan from a HP Officejet #09665907

Once the end user downloads and previews the malicious attachment, a script inside the HTML file will attempt to load client-side exploits for external compromised web sites.

End and corporate users are advised to report the emails as spam/malicious and avoid interacting with the content of the email messages.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Zero Day”

Topics

Hewlett-Packard Co., Sophos Plc., Malware, E-mail, Exploit, Spyware, Adware & Malware, Cyberthreats, Viruses And Worms, Security, Dancho Danchev

Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, malware and cybercrime incident response.

Disclosure

Dancho Danchev

More details on Dancho Danchev's current and past professional affiliations, can be found in his LinkedIn profile.

Biography

Dancho Danchev

Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, and cybercrime incident response. He's been an active security blogger since 2007, and maintains a popular security blog sharing real-time threats intelligence data with the rest of the community on a daily basis. More details on Dancho Danchev's current and past professional affiliations, can be found in his LinkedIn profile. You can also follow him on Twitter

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
Ask a Question Start a Discussion
2
Comments
Add Your Opinion

Join the conversation!

Just In

Still running...
BearBrad 24th Feb
We've been seeing these bouncing off our email spam and AV scanners for almost 2 weeks now. It's tapered down a bit at the end of this week, but we're still seeing them.

Brad
View in thread
1 Vote
+ -
A little late?
rindis@... 24th Feb
I was getting a flood of those emails over a month ago. It's stopped now. Or else Thunderbird's spam filtering is picking them all up.
0 Votes
+ -
Still running...
BearBrad 24th Feb
We've been seeing these bouncing off our email spam and AV scanners for almost 2 weeks now. It's tapered down a bit at the end of this week, but we're still seeing them.

Brad

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

Blog Roll

Blog Archive

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix