CricketMX.com

Poison' pill email scam
Louisa Hearn
June 9, 2006 - 3:22PM

Google has become the target of a malicious spoof email campaign which attempts to peddle pills through a fake "Google Pharmacy" interface.

The threat was first detected in Sydney on Thursday by security company Surf Control, taking the form of an email claiming to be from Team Google.

Headed with a convincing replica of Google's illustrated banner, the spoof email reads: "We've just launched a pharmaceutical interfaces for Google, as well as several new features that will improve the Google experience for the people buying pills and using pharmaceutical interfaces."

It directs the victim to a pharmaceutical retail site where seemingly legitimate prescription medicines can be purchased, but also lurking on the website are two malicious trojans.

According to SurfControl, the email uses Google redirector and URL encoding to mask the malicious sites which claim to sell a selection of medications such as Viagra, Zoloft, Xanax, and Prilosec.

To make the page seem more convincing it displays a fake banner under the products that reads "accredited by Google pharmacy".

When a user clicks on the email link it drops two trojan horses which on their own are relatively harmless. The first trojan directs them to the website, and then the second opens up a backdoor in the security settings of a computer for future attacks.

SurfControl said despite the presence of the trojans, the first aim of the spoof is to fool people into buying medications they believe have been accredited by Google. "The whole cycle of spoofing or spyware is always there to make money but in the process they often deliver another payload," a spokeswoman said.

This might include turning the user's PC into a spam zombie which could then be used for downloading keylogging malware to steal confidential data.