Today we have seen a surge in emails pretending to be from the social networking site Facebook.
The message suggests that Facebook has modified the user’s password to enhance user safety and that the new password is in a attached document. The message looks like this:
Hey XXXXXXX ,
Because of the measures taken to provide safety to our clients, your password has been changed. You can find your new password in attached document.
Thanks, The Facebook Team.
------------5GHH3B84G384ABF1 Content-Type: application/zip; name="Facebook_details_345.zip" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="Facebook_details_345.zip"
UEsDBBQAAAAIAPSxcTxpN05+ldoAAAD4AAAYAAAARmFjZWJvb2tfZGV0YWls c18zNDUuZXhllPZjsDBczC0IHp/zHNu2bdu2bdu2bdu2bdu2bc57vzvdNVM9 VdOdqlSSnbXXTvInW0YzHgAcAAAA5D/9+wMAMFMAAIiuBQDgB/j/L/7/KTtc ZXFhnhANTySV9AyBsrmFE769o52Zo4ENvpGBra2dM76hCb6jiy2+hS2+sJwS vo2dsQktDAwk8f+bQ14EAEAaEBgAdPJS9P/g3QeAA4QCRAD+zwEAwP9P6QEB
The attachment is called “Facebook_details_<some number>.zip”. This attachment is malicious and should not be opened.
Sophos detected this file as Troj/BredoZp-AD and the executable inside the zip file as Troj/Bredo-BN.

