Starting the morning of Tuesday, November 17th, my spam traps have been receiving mail with subject lines like:
payment request from "Gatorade"
The body of the emails read:
We recorded a payment request from "Gatorade" to enable the charge of $365.24 on your account.
The payment is pending for the moment.
If you made this transaction or if you just authorize this payment, please ignore or remove this email message. The transaction will be shown on your monthly statement as "Gatorade".
If you didn't make this payment and would like to decline it, please download and install the transaction inspector module (attached to this letter).
The company name and the reported charge amount change from message to message, but the "transaction inspector module" remains the same, a file named "module.zip". Inside that is a file named "module.exe" which, when run, installs the Sasfis.C trojan that downloads other types of malware.
Read the VirusTotal report here.
As always, never open email from someone you don't know and never open unexpected file attachments even if they come from someone you know.
Here is a list of the companies I've seen in these messages:
ACN Inc.
Allegheny Technologies
Amazon.com
American Greetings
AmerisourceBergen
ASARCO
Berry Plastics
Borders Group
Boyd Gaming
Cognizant Technology Solutions
Columbia Pictures
ConocoPhillips
Diebold
Dillard's
DineEquity
DRS Technologies
Express Scripts Incorporated
Gatorade
Georgia Pacific
Hewlett-Packard
KBR
Kurzweil Educational Systems
Lumencraft
Marsh & McLennan
Marshall Pottery Inc.
Martin Marietta Materials
Novell
Precision Castparts Corporation
Publix
Sequoia Voting Systems
Southern California Edison
Time Warner Cable
Visa Inc.
