Ebay phish. Looks like someone is hacking chat web applications...
Original location: http://www.hagerstenshamnen5.se/forum/chat/.a/index.htm index.htm is a VBScript file. Here is the probably malicious payload: http://www.little-kittel.de/mychat/chat/.a/aol.exe -- Steve Equal bytes for women. ---------- Forwarded message ---------- Return-Path: <[EMAIL PROTECTED]> Received: from CAMBER_SPSC.southplacerasc.com (66.238.188.196.ptr.us.xo.net [66.238.188.196]) by mail.pirk.com (8.14.1/8.12.0.Beta19) with ESMTP id m4OIcj5N029306 for <[EMAIL PROTECTED]>; Sat, 24 May 2008 11:38:46 -0700 Received: from MBGSERVERO1 ([71.249.240.146]) by CAMBER_SPSC.southplacerasc.com with Microsoft SMTPSVC(5.0.2195.6713); Sat, 24 May 2008 11:38:43 -0700 From: "eBay"<[EMAIL PROTECTED]> Subject: eBay - new ALERT message Date: Sat, 24 May 2008 14:38:43 -0400 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: <[EMAIL PROTECTED]> X-OriginalArrivalTime: 24 May 2008 18:38:44.0338 (UTC) FILETIME=[652BE520:01C8BDCD] You have 1 new ALERT message Please login to your eBay account and reactivate your Anti Fraud Program. To Login, please click the link below: Sign in to eBay © 2007 eBay. All rights reserved
_______________________________________________ phishing mailing list phishing@whitestar.linuxbox.org http://www.whitestar.linuxbox.org/mailman/listinfo/phishing
