We have been informed of a new case of Phishing that under the excuse of an alleged contract, seeks to trick the user into downloading a JAVA update. The mail in Portuguese is as follows (errors included):As requested, we are sending uma copia do procedimento contratual da empresa para que vossa senhoria possa analiso e ento nos retornar para que possamos dar continuidade na contratao dos servios.
Please enter em contato caso exista alguma davida.
Attentively,...
As you can see the HTML page has been hosted for free in DropBox and if the user enters the link, he will see an exact copy of the original JAVA page:As requested, we are sending uma copia do procedimento contratual da empresa para que vossa senhoria possa analiso e ento nos retornar para que possamos dar continuidade na contratao dos servios.
- Publicidad -Please enter em contato caso exista alguma davida.
Attentively, Assessoria Gonzaga
Marketing Manager[Baixe LIsta Ornament... pps]
Proposta... PDF Baixar
http://dl.dropbox.com/u/29611[REMOVED]/visual.html(64.0 KB)AWB: 369453
Protolo: 869478
Contract: 273467
The interesting and original thing about this particular case is that when you enter that page, thanks to a script, a popup will immediately open informing the user of an update and about the need for its installation:
This interesting method will undoubtedly be effective in many cases since as you can see the installation window is perfectly simulated and gives the feeling of being real. On the other hand, if that deception fails, the user could still press on the red "Free Download do Java" button and end up downloading the harmful application:
From Segu-Info we have already reported the case to DropBox, so that the file can be deleted.Update 23:50hs: We confirm from Dropbox the cancellation of the user and verify that the file is no longer available:
Kevin - Dropbox Support, May-19 04:05 pm (PDT):
This user has been banned for Terms of Service violation.
Thanks for bringing this to our attention.
Best
Kevin
Cristian from the Segu-Info Newsroom
