IRS Spoofing for Mal-ware

Published July 20, 2010 | By master

Remember, anyone can say they are sending mail from any address. Of course, the misspelling of “submission” and a lack of understanding what a W-2 doesn’t help their cause …

From: Internal Revenue Service [noreply@irs.gov]
Subject: W-2 form update
Attachments: w2form.doc (88 KB)

We would like to inform you that as of the 16th of June
you are late in updating your W-2 form submition with the new updated version. Please send us your completed W-2 update form by 01/07/2010. The updated version of the W-2 form is attached to this message.

Internal Revenue Service

And then you open it (the Word document itself is harmless):

But the object itself, actually named “Copy of p5020.exe” is the virus / mal-ware.

Posted in Emails Unfiltered