Email scammers hiding malware in fake IRS notices

Fake email messages claiming to come from the IRS contain Trojan Horse malware, says the IRS

If you get an email telling you that you're under investigation by the US Internal Revenue Service, take a breath before calling your lawyer. It's a scam.

The IRS warned Thursday of two fraudulent schemes that use the IRS's name in an attempt to get victims to install malicious Trojan Horse software on their computers.

In the first scam, the email claims to come from the IRS Criminal Investigation division. It says that the victim is under investigation for filing a false tax return. An attachment to the email, which appears to be the IRS's complaint, actually installs malicious software that gives the criminals access to the victim's PC.

The second scam email says a complaint about the victim's "business services" has been brought against them and advises that this can be arbitrated by the IRS.

The "complaint" attachment included in this scam is actually a new type of Trojan Horse called Backdoor.Robofo, according to security vendor Symantec.

Dispute arbitration is something the IRS doesn't do, according to Michelle Lamishaw, an IRS spokeswoman. "We're in the tax business. We're not in the arbitration business," she says.

In fact, any time you get an unexpected email from the IRS, it's almost certainly fake. "The IRS does not send out unsolicited emails," says Lamishaw.

But because these email messages appear to come from the taxman and relate to hot-button topics, some users may click, security researchers warn. "The use of legalese in the message content may intimidate some users into opening the attachment," wrote Symantec researcher Orla Cox, in a entry to the company's Security Response Weblog, posted on Thursday.

The IRS became aware of both scams over the past few days, as samples of the email messages were submitted by taxpayers to the email address that is used for reporting scams, Lamishaw says.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags phishingtrojanSecurity ID

Show Comments