[PBARC] Beware: Bank hoax

Fri, 9 May 2003 10:05:52 -0500

All -

This is likely to be the first of many (and its variants) to follow....  DON'T believe emails about your account information being lost.  Call your bank if you have any questions about your account.

Glenn

A hoax e-mail purporting to come from First Union Bank and attempting to dupe recipients to visit a malicious Web site is making the rounds on the Internet. 
The mail arrives from an address at Firstunion.com and informs the recipient that the bank has lost the recipient's online banking username and password. It directs users to a Web site where they are encouraged to enter their usernames and passwords, which are presumably then collected for later use by the scam artist who created the e-mail. 

The e-mail arrives from the address [email protected] and bank officials say they're unsure exactly how the sender was able to forge the address. Nor have they discovered how the attacker got a list of the bank's customers' e-mail addresses. 

Even if users don't enter their personal information in the form at the site, they could still be at risk. Simply visiting the site triggers an automatic download of the Backdoor-AMQ Trojan horse program to the visitor's machine, according to an advisory published Thursday by the Unified Incident Reporting and Alert Scheme, the U.K. equivalent of the CERT Coordination Center. 

Backdoor-AMQ is a well-known application that gives an attacker the ability to remotely control infected machines. Once installed a PC, the program allows an attacker to perform a number of tasks on the remote machine, including deleting and moving files, shutting down Windows, logging off users and hiding or killing applications, Windows and processes. 

Officials at Wachovia Corp., in Charlotte, N.C., which now owns First Union, said they first became aware of the scam in mid-April and have had some reports from customers who have been affected by it. 

"We've had some luck working with the authorities on this, but it's in their hands at this point," said Sandy Vasseur, a spokeswoman for Wachovia. "We don't know if any actual customer PCs were infected. But it's a credibility issue for us. We need to make it clear that this isn't from us." 

Vasseur said Wachovia never sends account information in e-mail messages. 

Thanks,

Glenn

Phone:
    Internal:  8-760-3948
    External: 870-541-3948
    Pager:    800 946-4646 1440500

EMail:
    Company: [email protected]
    Pager:      [email protected]
                   (about 120 characters)