[Dshield] FW: Osama Bin Laden Captured

David Vincent david.vincent at mightyoaks.com
Fri Apr 23 16:22:22 GMT 2004


'Osama Captured' e-Mail is Malicious Trojan
By Ryan Naraine

Those "Osama Bin Laden Captured" e-mails hammering your in-box today will
attempt to download a Trojan if the embedded URL is clicked, anti-virus
experts warned Friday.

Glendale, Calif.-based Panda Software said the URL embedded in the e-mail
directs users to what appears to be an advertising page before exploiting a
known security vulnerability in Microsoft's Internet Explorer (IE) browser
to download the trojan.

The fake news item, purporting to come from CNN or the BBC and promising
photographs and video of Bin Laden's capture, first appeared on instant
messaging networks earlier this month. According to security analysts, it is
yet another use of social engineering tactics by spammers to direct traffic
to Web sites.




> -----Original Message-----
> From: Louis Hablas [mailto:Lou.Hablas at rzim.org] 
> Sent: Friday April 23, 2004 7:19 AM
> To: Dshield (E-mail)
> Subject: [Dshield] FW: Osama Bin Laden Captured
> Importance: High
> Just received the following note...Of course, I immediately 
> checked CNN and
> found no mention and also did a quick header check.  Looks 
> like it came via
>, which is an open proxy.
> I did not visit the URL, but I imagine something bad awaits 
> those who do.
> Lou
> -----Original Message-----
> From: Rachelle Ray [mailto:ODJYBUCHYBCI at msn.com]
> Sent: Friday, April 23, 2004 11:13 AM
> To: Louis Hablas
> Subject: Osama Bin Laden Captured
> Just got this from CNN Osama Bin Laden has just been 
> captured! A video and
> some pictures have been released. Goto the link below for 
> pictures, I will
> update the page with the video as soon as I can: 
> God Bless America! 
> The information contained in this message may be CONFIDENTIAL 
> and is for the
> intended addressee only.  Any unauthorized use, dissemination of the
> information, or copying of this message is prohibited.  If 
> you are not the
> intended addressee, please notify the sender immediately and 
> delete this
> message.
> _______________________________________________
> list mailing list
> list at lists.dshield.org
> To change your subscription options (or unsubscribe), see: 
> http://www.dshield.org/mailman/listinfo/list

More information about the list mailing list