Malware hiding behind phoney FedEx messages

Scammers are exploiting FedEx's global brand

Security experts are issuing warnings following the discovery of a malware scam using email attachments.

The attack uses emails claiming to be from delivery service FedEx. The message claims that the user was unable to receive a package due to an address error and instructs users to print out an attached form to claim the package.

The attachment, however, contains a malicious .zip file which, when opened, triggers the malware attack. Security firm Sunbelt Software identified the malware as zbot.

Sophos senior technology consultant Graham Cluley said that the attack shows an interesting twist on the common tactic of hiding malware trojans as email attachments.

"Unlike many of the other Fedex-related malware attacks we have seen in the past, the emails carry the message about the failed delivery in the form of an image rather than text, possibly in an attempt to try to defeat more rudimentary anti-spam filters," Cluley said in a blog post.

Users are being advised to use common security best practices such as avoiding suspicious messages and not loading unknown or suspicious file attachments.