Spammers deliver bogus invoices

A new spam attack is pushing bogus package receipts

Security experts are warning of a rash of malicious spam disguised as a parcel tracker.

Researchers at McAfee said that the malware-laden spam uses the cover of a package tracking invoice to dupe unsuspecting users.

The messages tell the user that a package sent on 1 July could not be delivered and that the user should open the attached file and collect the package from a local post office.

When the user loads the supposed invoice, the malware attack is launched. The attached .zip archive unloads a .exe Trojan file which then unpacks a spyware program designed to steal user data for several job recruiting sites.

The majority of the messages have attempted to impersonate UPS, although McAfee has also found examples purporting to be from the US Customs Service.

McAfee has tied the same Trojan to another attack which targets the user with a fraudulent receipt for an airplane reservation.

The company believes that the spam run will continue for several days and is advising users to avoid visiting any suspicious URLs and not to launch any unexpected or suspicious email attachments.