A second IRS spam and virus campaign, this time targeting people instead of businesses, is making its way around the Web. The campaign captured by Red Condor filters on Thursday, February 11, 2010, has a subject line, “You are in a higher tax bracket.” The unsophisticated email campaign suggests that recipients are now considered to be in a higher tax bracket, because their “annual income for the last tax year has increased.” Recipients are then asked to review their annual tax report by clicking on a link to a report.
The link goes to a page that attempts to download a PDF file containing the “JS:pdfka-gen” virus. When originally run through VirusTotal and JottiVirusScan less than 10% of virus engines had detected the campaign (3 out of 40) and Jotti showed 2 out of 20. As of the early afternoon on February 11, Red Condor had blocked more than 60,000 messages.
As mentioned in previous posts about IRS scams, the IRS will not contact individuals directly through email.
Update: As of 2:00 p.m. PDT on Friday, February 12, Red Condor had blocked more than 400,000 messages belonging to this campaign.
