Computerworld - Security experts today warned consumers of a rapidly mutating spam campaign using bogus messages from United Parcel Service (UPS) claiming that a package could not be delivered.
The spam run, which actually began earlier this month, is just one way that security researchers believe criminals will exploit the holiday season online buying spree.
According to Cloudmark engineering director Angela Knox, the UPS-based scam uses phony email to dupe recipients into either opening an attachment or clicking on a link to infect machines with malware.
"We've seen a number of variants in this campaign, some with attachments, some with no attachments and bad links, all of them personalized to the recipient, and sent from an ever-changing list of fake UPS employees or the generic 'UPS Customer Services,'" said Knox in a blog post today.
The attached files are actually .zip archives that contain malware, said Knox, while the links lead to compromised or hacker-controlled websites that host attack code.
"With Cyber Monday kicking off the online holiday shopping frenzy, online shoppers should remember to be vigilant about any email message that they receive," said Knox.
Other security experts echoed that as they cataloged a host of ways criminals could subvert online shopping.
Wolfgang Kandek, chief technology officer of Qualys, warned of hackers exploiting the popularity of discount services such as Groupon and Living Social to feed malicious links via all kinds of avenues, including Twitter, Facebook, email and instant messaging.
Meanwhile, Dell SecureWorks today reported an uptick in malicious messages posing as problems with recipients' airline tickets, canceled direct deposits and -- as Cloudmark noted -- shipping invoices.
The malware planted on fooled users' PCs includes the notorious Zeus Trojan horse, which has been implicated in numerous thefts from U.S. consumers and small businesses, said SecureWorks today.
Experts urged users -- both at home and at work, where many shop using their office's faster Internet connection -- to be wary of fake sites and too-good-to-be-true discounts pitched via email and social media.
SecureWorks also encouraged users to ensure that their browsers and browser plug-ins, especially document viewers such as Adobe Reader, music and video player utilities like Flash, are up to date with the most recent security patches.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at 
@gkeizer, on Google+ or subscribe to Gregg's RSS feed 
. His e-mail address is gkeizer@computerworld.com.
See more articles by Gregg Keizer.
Read more about Cybercrime and Hacking in Computerworld's Cybercrime and Hacking Topic Center.
Free Insider GuideCopyright © 1994 - 2012 Computerworld Inc. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of Computerworld Inc. is prohibited. Computerworld and Computerworld.com and the respective logos are trademarks of International Data Group Inc.
