Adobe Woes Bring Malware Offerings

Friday, December 9, 2011 @ 04:12 PM gHale

It only makes sense with all the problems Adobe has been having of late, but now cybercriminals are spamming out a malware attack posing as upgrades for Adobe Acrobat Reader and Adobe X Suite Advanced.

The emails, which pretend to come from Adobe, have a ZIP file attached which contains a version of the Zeus Trojan horse, designed to steal banking information from compromised computers.

Adobe Hit with Zero Day
Attackers Clean Out Duqu Servers
Attackers Hijack MIT Server
Zeus Now Using Autorun

The risk is that less technical-savvy computer users might believe the email is legitimate, and then they will install the malware onto their computer thinking that it is an official Adobe update.

Here is a sample of what the email says:

Subject: Adobe Software Upgrade
Notification ID: [random number]
Attached file: AdobeSystems-Software_Critica Update Dec_2011-[random].zip
Hello Dear,
Adobe is pleased to announce new version upgrades for Adobe Acrobat Reader and Adobe X Suite Advanced features include:
– Collaborate across borders
– Create rich, polished PDF files from any application that prints
– Ensure visual fidelity
– Encrypt and share PDF files more securely
– Use the standard for document archival and exchange
To upgrade and enhance your work productivity today please open attached file.

Copyright 2011 Adobe Systems Incorporated. All rights reserved.
TrackNum: [random ref number]
Adobe Systems Incorporated,

Each email is slightly different, incorporating different reference numbers in the subject line, attached filename and message body. But the samples seen so far all carry malware in the file “Adobe Systems Software Critical Update Dec 2011.exe” contained within the ZIP.

Computer users need to understand Adobe never sends up software updates as an email attachment, and any legitimate upgrades should always download from Adobe’s own website. It’s trivial for a malicious hacker to forge an email header to trick the unwary into believing an email has been sent from someone else — so just because it claims to be from Adobe, doesn’t mean that it was sent by them.

Antivirus products are detecting the ZIP file as Troj/BredoZp-GY and intercepting the messages as spam.

Leave a Reply

You must be logged in to post a comment.