Security experts warn of fake Microsoft bulletin

By Matt Whipp

Posted on 29 Jun 2005 at 17:23

Finnish security experts F-Secure are warning of a fake Microsoft bulletin being spammed out since early this morning.

The email claims to be bulletin MS05-039, although June's patches were numbered -034. Microsoft never actually sends out security bulletins via email in any case, but the structure of the email is very close to that of a genuine bulletin description.

F-Secure says that the web address to which the email urges recipients to visit resides on a hacked server. Quite what a visitor will end up downloading from there still isn't clear, but the company says that bandwidth to that address is currently at full stretch, indicating that large numbers of victims are about to find out.

A similar ruse was tried in late 2003 in the form of the Swen worm, which again used professional presentation to ensure as many people as possible installed the malicious attachment.