Gone fishing… Sorry: Phishing - Wachovia Treasury
October 8, 2008
Filed under
Online Security
If you’re a Wachovia customer, please be aware that currently an extremely active phishing attack is in course. Basically You receive emails asking you to download some badware from a faked website. After the badware is installed, starts to collect all the data which the browsers, especially IE stored, including passwords and sends the data on TCP to a remote server.
The phishers are using the following text:
WACHOVIA CORPORATION NOTICE.
At Wachovia we’ve re-imagined what’s possible for online cash management.
The next step in the transformation of Wachovia Connection is access through a new Wachovia Security Plus Certificate.
This will allow you to access securely the Wachovia Connection and other online services.
All users will be notified and must manually install the Wachovia Security Plus Certificate.
Installation takes about two minutes.Start installation process now>>
Sincerely, Booker Hemphill.
2008 Wachovia Corporation.
All rights reserved.
Update: Just got another one:
WACHOVIA CORPORATION NOTICE.
Citigroup announced a buyout of Wachovia brokered by the FDIC moments ago.
All Wachovia bank locations will be in the Citigroup merger to prevent failure of Wachovia.
The Citigroup/Wachovia would focus on upgrading banks’ security certificates.
All Wachovia customers must fill the forms and complete installation of new Citigroup Standard digital signatures during 48 hours.
Please follow the installation steps below:Sincerely, Rudy Kane.
2008 Wachovia Corporation.
All rights reserved.
The message header contains some very crucial information as always: the sender is from Romania, the message was sent from the following IP Block: 83.103.160.128 - 83.103.160.143 which is under AstralTelecom’s administration.
Do not click anything in suspicious emails! If they talk about a new feature by your online bank, first open up a web browser window, type the bank’s address in the address-bar and try to find information directly from the provider.
Never trust emails!
Possible related posts (automatic):
Related posts brought to you by Yet Another Related Posts Plugin.
Comments
Tell us what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!
If you want to use your OpenID, fill out the field labeled "Website" with the OpenID URL. The other fields may remain empty.