Messages insisting that users install a just-released Microsoft Corp. security update are bogus and actually lead to a site that plants malicious code on PCs, several security companies warned today.
The spam, which touts "Microsoft Security Bulletin MS07-0065 -- Critical Update" as its subject and appears to come from "update@microsoft.com," claims users should download a June 18 security patch and provides a link to a URL that looks legit.
"A new 0-day vulnerability has appeared in the wild," the message reads. "The vulnerability affects machines running MICROSOFT OUTLOOK and allows an attacker to take full control of the vulnerable computer if the exploitation process is succesfull [sic]." It goes on to boast that 100,000 PCs have been hijacked so far by unnamed malware exploiting the bug.
|