"Wire Transfer Confirmations" email leads to BlackHole Exploit site

Sophos Labs intercepted a spam campaign that claim to be related to a rejected wire transfer.

Although most savvy computer users would realise that unsolicited email is unlikely to be legitimate, there are some who might be vulnerable or merely curious enough to click on the HTML attachment, not realising that it can cause problems for their PC.


When user open the The HTML attachment , it displays 'Please wait a moment. You will be forwarded...'.


In the background, an obfuscated piece of code is performing a redirect to a hijacked Russian site that hosts Blackhole, the infamous exploit kit that leverages all sorts of known vulnerabilities to serve malware.