Trojan Attack Masquerades As Airline E-Ticket Notice

Security researchers have spotted a new attack designed to fool users into thinking that airline tickets have been purchased with their credit cards.

The attack, which was first spotted as an email from Northwest Airlines, and subsequently as a message from United Airlines, is a realistic-looking "receipt" that contains an attachment bearing the name Your_ETicket.zip or eTicket.zip, according to researchers at security vendor Sophos.

The idea is to fool the unwitting user into clicking on the attachment to get more information on who purchased it, according to Graham Cluley, a researcher at Sophos. "The file doesn't contain a genuine electronic ticket, of course, and your credit card has not been charged," he says. "The hackers are hoping that you will be so affronted at being charged for an airline flight that you haven't booked that you will open the attachment without thinking."

Users who click on the e-ticket file trigger the download of Troj/Agent-IPS, a data-stealing Trojan horse.

The airline ticket disguise isn't new, Cluley notes. A similar scam was detected early last month, and a broader scam took place in the middle of last year. Cluley warns users who receive the messages to keep their cool.

"Although it's understandable that you might panic into thinking that your credit card has been debited without your permission for a flight you don't want or need, you should be cynical enough to smell this for what it is -- a dirty, rotten scam designed to infect your personal computer," Cluley says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message