Anti-virus vendors have issued an urgent warning about a fast-spreading new variant of the Mimail worm that appears to be after the money in recipients` bank accounts.
The new variant, Mimail-I, arrives in an e-mail with a subject line relating to "PayPal.com member, account details" or "Your PayPal.com account expires". The e-mail message carries a PayPal logo and asks recipients to enter their credit card details, then forwards them automatically to a central point.
Netxactics, local Sophos distributor, says the worm is spreading fast in New Zealand, Australia, the UK and SA, and appears to be "following the sun" to the US.
Brett Myroff, Netxactics CEO, says the e-mail tells the recipient not to send personal information through e-mail (ironically advising users that e-mail is insecure) and instructs users to run an attached program instead.
"If you run the program, attached in a file called www.paypal.com.scr, a dialogue box pops up requesting you to enter a range of information about your credit card. This includes your full credit card number, your PIN, the expiry date, and even the so-called CVV code (this is an additional three-digit security code printed on the back of your card which is not recorded by credit card machines during transactions).
"Mimail-I tries to harvest your bank card data and then sends it out to the bad guys in an e-mail," says Myroff. "It even includes a realistic-looking checkbox which you are expected to tick in order to confirm that the details you have entered are correct.
"But the e-mail sent to you by Mimail-I could never be legitimate," Myroff points out. "Banks and credit card companies never request information of this sort via e-mail, just as computer security companies never send out patches this way. E-mail is simply not secure enough for transactions of this type."
Ken Dunham, director of Malicious Code at iDefense, adds that the new worm could be the start of a dangerous new trend - a migration of virus writers` motives away from notoriety towards criminal gain.
As well as stealing bank information, Mimail-I sends itself to everybody whose e-mail addresses appear on the user`s hard disk, which is likely to generate a lot more e-mail traffic than computer users may have bargained for.
Share
