Internet scammers are sending out fake Microsoft "Windows Genuine Advantage" queries to trick users into installing spyware programs.Security researchers have set off the alarm for a new phishing scam that piggybacks on Microsofts plans to make its "Windows Genuine Advantage" anti-piracy initiative
mandatory later this year.
According to an advisory from Websense Inc., Internet scammers are blasting out e-mails with spoofed sender addresses to trick users into downloading a so-called security tool.
The e-mails arrive with the subject line "Microsoft Windows Update" and the sender is listed as "security@microsoft.com," the company said.
Even though Microsoft never sends out security updates via e-mail, Websense said the news that Microsoft plans to clamp down on the way updates are released to pirated versions of Windows could fool users into launching the download.
Websense said the e-mail points to a URL that is hosted in Romania. Once the user accesses the site in Romania, a Microsoft Internet Explorer Browser Helper Object (BHO DLL) is installed on the machine.
The Browser Help Object is flagged as malicious spyware, the company warned.
A second version of the phishing attack also claims to be from Microsoft and claims that many people are illegally using its services without paying. The scammers attempt to fool users into updating credit card information.
"The e-mail links to a Web site which, upon accessing, attempts to install a Browser Helper Object which is then installed on the machine. The BHO is also spyware," Websense added.
The company also issued an alert for separate phishing attack that takes advantage of an apparent hole in Yahoo Inc.s search engine to redirect users to fraudulent Web sites.
Click here to read about an anti-spyware consortium that has fallen apart.
"Websense Security Labs has seen attacks and a variety of targets throughout last night and today that are using this technique to alleviate e-mail spam filters and other URL filters," the company warned.
Websense said the phishing attack method was detected in the past in the Lycos and Google search engines.
Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.
Network Security & Hardware 
